CVE-2013-4786

CVE Enrichment

CVSS: 7.5 HIGH
EPSS: 98.39%
EPSS Percentile: 99.92%
CISA KEV: Not listed

Description

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

Technical Details

CVSS Version: 3.0
CNA / NVD Source: [email protected]
Published: 09-Jul-2013 05:55
Last Modified: 10-Oct-2026 02:16
EPSS Date: 2026-10-26
CWE: CWE-255

CVSS Vector


            CVSS:3.0                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

Affected Products / Versions

oracle / fujitsu_m10_firmware Source: NVD CPE · affected
Version / affected range: * · through (inclusive) 2290
cpe:2.3:o:oracle:fujitsu_m10_firmware:*:*:*:*:*:*:*:*
intel / intelligent_platform_management_interface Source: NVD CPE · affected
Version / affected range: 2.0
cpe:2.3:a:intel:intelligent_platform_management_interface:2.0:*:*:*:*:*:*:*

References

Last enrichment sync: 27-Oct-2026 03:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

Researchers found more than 36,000 internet-exposed BMC management interfaces running IPMI, with nearly 25,000 leaking password-derived authentication hashes before login because of CVE-2013-4786 in IPMI v2.0. Researchers Find 24,650 Exposed BMCs Leaking IPMI Password Hashes
More than 24,000 internet-exposed servers are leaking authentication password hashes because of CVE-2013-4786, an old IPMI 2.0 flaw in Baseboard Management Controller interfaces. Researchers Find 24,650 Internet-Exposed Servers Leaking IPMI Authentication Material

Malware (1)

People (2)

MITRE ATT&CK (2)

Vendors (3)

Products (1)

Industries (2)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.