# 24,650 Exposed BMCs Are Leaking Password Hashes to Anyone Who Asks


## The Threat


A scan of the public internet in early May 2026 found 36,872 Baseboard Management Controller (BMC) interfaces exposing the Intelligent Platform Management Interface (IPMI) on UDP port 623 — and nearly 25,000 of them are handing out password-derived authentication hashes to anyone who reaches out, no login required. The research, conducted by security firm Lava and shared with The Hacker News, puts a hard number on a threat the security community has been quietly dreading for over a decade.


The root cause is CVE-2013-4786, a flaw baked into the IPMI v2.0 specification itself. During the RMCP+ Authenticated Key-Exchange Protocol (RAKP) handshake, a BMC responds to an unauthenticated authentication request by returning an HMAC-SHA1 code derived from the account password and session values. An attacker who can reach UDP port 623 can collect that HMAC and crack it offline — no repeated login attempts, no rate-limit exposure, no log entries on the target. Dell's advisory on this flaw is blunt: "this is an inherent problem with the specification for IPMI v2.0," and there is no patch.


What makes this explosive in 2026 is context. More than 30% of the recovered hashes resolved to plaintext passwords using common wordlists or predictable factory chassis-sticker formats. Researcher Michael Katchinskiy found the exposure reaching across modern Supermicro and HPE hardware operated by GPU cloud providers — some still running factory-issued credentials. BMCs control power, firmware, remote console, OS installation, and system recovery. They operate independently of the host OS, meaning an attacker who cracks one doesn't just own a server — they own it persistently, surviving reboots and OS reinstalls.


## Severity and Impact


| Field | Detail |

|---|---|

| CVE | CVE-2013-4786 |

| CVSS Score | 7.5 (High) |

| Vector String | AV:N/AC:L/Au:N/C:P/I:N/A:N (CVSSv2) |

| Attack Complexity | Low |

| Authentication Required | None |

| CWE | CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) |

| Protocol | IPMI v2.0 over RAKP/RMCP+ (UDP port 623) |

| Patch Available | No — specification-level flaw |


## Affected Products


The vulnerability is inherent to IPMI v2.0 and affects any BMC implementing the specification. Confirmed affected hardware includes:


  • Supermicro — modern server hardware (confirmed exposure in GPU provider environments)
  • HPE — modern server hardware (confirmed exposure in GPU provider environments)
  • Dell — acknowledged the spec-level flaw; no remediation available
  • Any vendor implementing IPMI v2.0 on internet-exposed BMC interfaces

    • Geographic distribution of the 36,872 exposed hosts (as of May 6, 2026):

  • United States: 14,000+
  • Germany, China, Netherlands, United Kingdom: significant concentrations

    • ## Mitigations


    There is no patch for CVE-2013-4786 because the flaw lives in the specification, not a specific implementation. Mitigation is entirely operational:


    Immediate actions:

  • Remove BMC interfaces from the public internet. This is non-negotiable. BMC management should never be internet-routable.
  • Rotate all IPMI credentials immediately, particularly any factory-issued or default passwords. Assume any hash exposed on a reachable interface has been collected.
  • Audit UDP port 623 exposure across your infrastructure using your asset inventory or a tool like Shodan/Censys.

    • Architecture controls:

  • Place BMC/IPMI interfaces on a dedicated out-of-band management network, isolated from both production and internet-facing segments.
  • Enforce access via VPN or zero-trust gateway before any BMC interface is reachable.
  • Apply network ACLs that whitelist only authorized management hosts to UDP 623.
  • Disable IPMI over LAN entirely if Redfish or another management protocol is viable for your environment.

    • Credential hygiene:

  • Use long, random passwords for all IPMI accounts — not chassis serial numbers, not vendor defaults.
  • Where hardware supports it, disable unused IPMI user accounts.
  • Consider disabling the RAKP-based authentication path if the BMC firmware offers alternatives.

    • Detection:

  • Log and alert on any RAKP authentication requests originating from unexpected sources, even if authentication ultimately fails.
  • Monitor for offline password-cracking activity targeting recovered IPMI hashes in threat intelligence feeds.

    • ## References


  • [Lava Research / The Hacker News Report](https://thehackernews.com)
  • [Dell Advisory on CVE-2013-4786](https://www.dell.com/support/security)
  • [Eclypsium BMC Security Research (2022–2023)](https://eclypsium.com)
  • [NVD Entry: CVE-2013-4786](https://nvd.nist.gov/vuln/detail/CVE-2013-4786)

    • ---


    ## HackWire Analysis


    CVE-2013-4786 is thirteen years old. The advisory that named it was published in 2013. The IPMI v2.0 specification flaw it describes was already known to be unfixable. None of that is new. What is new — and what the Lava research forces into focus — is that nearly 25,000 production servers are still sitting on the open internet leaking credentials in 2026, a significant chunk of them inside AI infrastructure.


    That last detail deserves more attention than most coverage is giving it. GPU cloud providers run bare-metal environments where a single hypervisor host may carry workloads from multiple tenants. A compromised BMC at that layer doesn't just threaten one customer's data — it threatens persistent, out-of-band access to shared physical infrastructure that survives any logical security boundary. An attacker who cracks an IPMI credential on a GPU node doesn't land in a container or a VM. They land in the firmware layer, with the ability to reflash BIOS, intercept console I/O, and maintain access through every OS reinstall the operator ever runs.


    The 30% hash recovery rate is the other number that should be alarming practitioners. That's not sophisticated cryptanalysis — that's dictionary attacks against factory passwords and chassis sticker formats. These are credentials that vendors shipped knowing the hash would be freely available to anyone on the network. The expectation was always that BMC interfaces would never be internet-routable. Fourteen thousand exposed U.S. systems suggest that expectation has failed catastrophically at scale.


    For defenders: run your own Shodan query against your ASN for UDP/623 today, before someone else does it for you. If you find exposure, treat the associated credentials as fully compromised and rotate immediately.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)