Researchers Find 24,650 Exposed BMCs Leaking IPMI Password Hashes
Summary
Researchers found 24,650 of 36,872 internet-exposed IPMI interfaces disclosed password-derived hashes due to CVE-2013-4786, enabling offline password guessing. Dell says the flaw is inherent to IPMI v2.0 and has no patch.
Key points
- A scan as of May 6, 2026, found 36,872 internet-exposed hosts running IPMI on UDP port 623; 24,650 disclosed password-derived authentication material before login.
- CVE-2013-4786 lets unauthenticated remote users request an IPMI v2.0 RAKP response and test password guesses offline.
- Researcher Michael Katchinskiy said more than 30% of returned hashes matched passwords recoverable with common wordlists or predictable factory formats.
- Lava reported recovering HPE iLO factory passwords in under a minute and Supermicro factory passwords in about an hour in its tests.
- Dell describes the issue as inherent to the IPMI v2.0 specification and says there is no patch; Supermicro said it will evaluate default-password improvements for future hardware.
- Recommended defenses include blocking UDP port 623, changing factory passwords, disabling weak legacy options, and restricting BMC access to a dedicated management network.
- The article reports ransomware operators have targeted exposed BMC interfaces, including an extortion note on an HPE iLO 4 login page, but says the actor is unknown.
Article Details
- Vulnerability Types
- Authentication hash disclosure
- Offline password guessing
- Severity
- High (CVSS 7.5)
- Affected Versions
- IPMI v2.0
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Block UDP port 623 at the network edge.
- Rotate factory-issued passwords during provisioning.
- Disable legacy or weak options such as IPMI 1.5.
- Restrict BMC access to a dedicated private management network.
- Use network access controls to allow only approved administrative systems to reach BMC interfaces.
MITRE ATT&CK
T1110.002 · Password CrackingThe disclosed HMAC authentication material can be used to test password guesses offline, including guesses against weak or factory-set passwords.T1190 · Exploit Public-Facing ApplicationAn unauthenticated remote party can reach an internet-exposed BMC over UDP port 623 and exploit the IPMI v2.0 flaw to obtain authentication material.
CVE
People
Malware
Vendors
DellPer an advisory released by Dell, “this is an inherent problem with the specification for IPMI v2.0,” with the PC maker noting that there is no patch.Hewlett Packard EnterpriseThe exposure affects systems from vendors including HPE and Supermicro, and attackers could use the flaw to crack weak or factory-set passwords offline and gain deep control over servers.SupermicroThe exposure affects systems from vendors including HPE and Supermicro, and attackers could use the flaw to crack weak or factory-set passwords offline and gain deep control over servers.
Products
Countries
ChinaThe remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.GermanyThe remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.NetherlandsThe remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.United KingdomThe remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.United StatesAs of May 6, 2026, a search of the public internet for IPMI services exposed on UDP port 623 uncovered 36,872 unique hosts, of which more than 14,000 are located in the U.S.
Industries
AI infrastructureAs AI infrastructure rapidly expands, securing this layer has become far more urgent.”Data centers“In modern AI data centers, where the same bare-metal environment often hosts multiple tenants, a single exposed BMC can potentially place multiple organizations’ workloads at risk through shared infrastructure or