Server BMCs Leak Password Hashes via 20-Year-Old IPMI Flaw

More than 24,000 internet-exposed servers are leaking authentication password hashes through a 20-year-old vulnerability in their Baseboard Management Controller interfaces. Researchers at cybersecurity firm Lava discovered that CVE-2013-4786, an IPMI 2.0 authentication flaw dating back to 2004, remains actively exploitable on systems worldwide. Consequently, attackers can crack administrator passwords offline and gain persistent control beneath the operating system layer.

What Happened: 24,000 BMCs Leak Password Hashes via 20-Year-Old IPMI Flaw

Researchers at Lava scanned the internet for exposed IPMI services on UDP port 623. They found 36,872 publicly reachable hosts. Furthermore, 24,650 of those hosts disclosed password-derived authentication material that enables offline password cracking.

The flaw is CVE-2013-4786, a weakness in the IPMI 2.0 authentication protocol. During the authentication handshake, the BMC returns an HMAC-SHA1 code calculated using the account password and session values known to the requester. An unauthenticated attacker can capture this response and test password guesses offline at high speed. Therefore, no failed login attempts are recorded on the target system.

The United States hosts 39 percent of the vulnerable servers. Moreover, Lava found that over 30 percent of the exposed hashes could be cracked using common wordlists and predictable factory password formats. In one case, researchers discovered a ransom note demanding 0.3 BTC on an exposed HPE iLO 4 login page. This confirms that malicious actors are already targeting these exposed interfaces.

Technical Details of the BMC IPMI Authentication Weakness

A Baseboard Management Controller is a dedicated processor built into server motherboards. It provides out-of-band management independent of the operating system. Administrators use BMCs to power-cycle hosts, mount virtual media, update firmware, and access remote console sessions. In practice, a BMC is one of the most privileged control points in any data center.

The vulnerability resides in the IPMI 2.0 RAKP authentication exchange. When an unauthenticated client initiates a session, the BMC returns a password-derived hash before the client proves its identity. This design choice allows offline cracking because the attacker already possesses the session values needed to verify guesses.

The attack chain works as follows:

• The attacker sends an IPMI 2.0 RAKP message to UDP port 623 on an exposed BMC
• The BMC responds with an HMAC-SHA1 authentication code derived from the password
• The attacker captures this response and begins offline password guessing
• Weak, reused, or factory-default passwords are recovered without generating failed login events
• The attacker logs into the BMC with the recovered credentials and gains full management access

Affected Systems and Exposure Breakdown

Lava identified 36,872 internet-exposed IPMI hosts as of May 6, 2026. The exposure statistics are alarming:

• 24,650 hosts returned password-derived authentication hashes vulnerable to offline cracking
• 6,240 hosts accepted an empty username and used weak passwords
• 2,340 instances used administrator passwords matching public dictionaries
• 39 percent of exposed servers are located in the United States

Many of the vulnerable systems are modern Supermicro servers protected by 10-character uppercase passwords printed on factory chassis labels. Additionally, researchers estimated that recovering an HPE factory password would take approximately one day per captured response on an Apple M3 laptop. For attackers with GPU rigs, the timeline shrinks dramatically.

Business and Operational Impact

A compromised BMC gives attackers control beneath the operating system. Most security tools monitor the OS, kernel, containers, and workloads. However, the BMC operates outside that trust boundary. This makes detection and remediation extraordinarily difficult.

The impact extends well beyond a single server. BMCs typically share out-of-band management networks with weak segmentation and reused credentials. Therefore, one compromised BMC can serve as a pivot point to the broader data center management plane. Malicious firmware changes can also survive OS reinstalls and disk replacements.

The risk is especially acute in AI and cloud infrastructure environments. GPU providers often connect bare-metal servers to shared provider-managed out-of-band networks. A single compromised BMC can therefore expose multiple tenant workloads simultaneously. Lava researchers warn that in poorly segmented AI environments, one physical server compromise can disrupt or expose several customer workloads.

The key impact categories include:

• Full server compromise: Attackers gain persistent control independent of the operating system
• Data center pivoting: Shared management networks enable lateral movement across infrastructure
• Multi-tenant exposure: AI cloud environments face cross-tenant risks from one compromised host
• Firmware-level persistence: Malicious BMC firmware survives standard incident response procedures
• Ransomware extortion: Exposed HPE iLO 4 interfaces already display ransom demands

Mitigation and Recommendations

Immediate Actions for Defenders

1. Remove IPMI from the public internet. Block inbound UDP port 623 at the network edge immediately. IPMI and Redfish should never be exposed directly to the internet.
2. Rotate all factory BMC passwords. Change default credentials on every BMC. Use strong, unique passwords that do not follow predictable patterns.
3. Audit exposed systems. Scan your external IP ranges for IPMI on UDP port 623. Inventory every exposed interface and assess its risk.
4. Segment management networks. Isolate BMC and out-of-band management traffic on dedicated networks with strict access controls.
5. Review server logs and firmware integrity. Check for unauthorized logins, unexpected virtual media mounts, and firmware modifications.

Additional Hardening Steps

Organizations should also adopt longer-term defensive measures. Disable legacy IPMI authentication where possible and migrate to Redfish with strong TLS and certificate pinning. Furthermore, implement network-level monitoring on management subnets to detect lateral movement and anomalous access patterns. For AI and cloud providers, review tenant isolation architecture and ensure that out-of-band networks are not shared across customer boundaries.

Bottom line: A 20-year-old protocol flaw is exposing tens of thousands of servers to offline password cracking and persistent compromise. Take IPMI off the internet today, rotate every factory password, and isolate your management networks before attackers do it for you.

Incident Summary

CVE ID / Incident:	CVE-2013-4786 (IPMI 2.0 authentication weakness)
Affected Systems:	Baseboard Management Controllers exposing IPMI 2.0 on UDP port 623; Supermicro, HPE, Dell, Lenovo, and other server platforms
Disclosure Date:	July 28, 2026 (Lava research publication)
Patch Status:	No patch available; protocol-level weakness. Mitigation requires network isolation and credential rotation.
Severity:	High — unauthenticated password hash disclosure enabling offline cracking
Exploit Status:	Actively exploitable; ransom notes observed on exposed systems
Researcher:	Lava cybersecurity research team

References

1. Bill Toulas, “Over 24,000 exposed server BMCs leak password hash via decades-old flaw,” BleepingComputer, July 28, 2026, https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/, accessed July 29, 2026.
2. Lava Research Team, “How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability,” lavahq.io, July 28, 2026, https://lavahq.io/research/bmc-exposure-alert, accessed July 29, 2026.
3. NIST National Vulnerability Database, “CVE-2013-4786,” NVD, https://nvd.nist.gov/vuln/detail/CVE-2013-4786, accessed July 29, 2026.
4. SC World, “IPMI bug in BMCs found after 22 years, exposes 24,000-plus servers,” SC World, July 29, 2026, https://www.scworld.com/news/ipmi-bug-in-bmcs-found-after-22-years-exposes-24000-plus-servers, accessed July 29, 2026.