Ethical Hacking News
A recent discovery has revealed that over 36,872 Baseboard Management Controller (BMC) management interfaces are exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet, posing a significant threat to server security. The exposure of IPMI password hashes before login can be recovered using common wordlists and predictable factory chassis-sticker formats, making it essential for organizations to take proactive measures to address this vulnerability.
The discovery reveals over 36,872 BMC management interfaces exposing IPMI protocol to the public internet. The vulnerability (CVE-2013-4786) poses a significant threat to server security due to an information disclosure flaw. Remote attackers can obtain password hashes for valid accounts and conduct offline password guessing attacks. The exposure affects over 24,650 BMCs worldwide. The risk has increased with the emergence of GPU cracking technology and modern AI environments. Mitigation measures include blocking UDP port 623, rotating factory-issued passwords, and applying network access controls.
In a recent discovery, cybersecurity researchers have identified more than 36,872 Baseboard Management Controller (BMC) management interfaces that are exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. This vulnerability, known as CVE-2013-4786, has been found to be present in IPMI v2.0 specification and poses a significant threat to server security.
The issue at hand is a high-severity information disclosure flaw that allows remote attackers to obtain password hashes for valid accounts and conduct offline password guessing attacks. This means that an attacker can potentially recover weak, reused, factory-set, or predictably formatted passwords by obtaining the HMAC-SHA1 authentication code calculated using the account password and session values known to the requester.
The exposure of IPMI password hashes before login has been found in more than 24,650 BMCs, which are specialized management processors embedded on a server's motherboard that control power, firmware, remote console access, operating system installation, and system recovery. These BMCs also act as a crucial component for remote data center automation and uptime to monitor hardware telemetry and facilitate mass deployment of firmware updates and BIOS configurations.
The risk around this vulnerability has increased due to the emergence of GPU cracking technology, which has made offline password recovery faster. Moreover, modern AI and bare-metal environments have made each exposed server more valuable. This is further exacerbated by evidence that threat actors are already targeting internet-exposed BMC interfaces, including ransomware operators leaving an extortion note on an HPE iLO 4 login page.
To mitigate this risk, it is advised to block UDP port 623 at the network edge, rotate factory-issued passwords during provisioning, disable legacy or weak options such as IPMI 1.5, restrict BMC access to a dedicated private management network, and apply network access controls to ensure only approved administrative systems can reach BMC interfaces.
In conclusion, the exposure of IPMI password hashes before login poses a significant threat to server security. It is imperative that organizations take proactive measures to address this vulnerability and prevent potential attacks on their infrastructure.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Looming-Threat-of-Exposed-IPMI-Password-Hashes-A-Cautionary-Tale-for-Cybersecurity-ehn.shtml
https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.html
https://nvd.nist.gov/vuln/detail/CVE-2013-4786
https://www.cvedetails.com/cve/CVE-2013-4786/
Published: Tue Jul 28 11:37:08 2026 by llama3.2 3B Q4_K_M
