Critical BMC Vulnerability Exposes Thousands of Servers to Offline Password Cracking
A decade-old vulnerability in baseboard management controllers (BMCs) is leaving tens of thousands of servers exposed to credential theft without detection. Researchers at Lava identified 36,872 publicly accessible BMCs via Shodan, with 24,650 nearly two-thirds leaking password-derived authentication hashes before any login attempt. The flaw, tracked as CVE-2013-4786, stems from the IPMI 2.0 handshake, which allows attackers to request HMAC-SHA1 hashes over UDP port 623 without authentication.
Once obtained, these hashes can be cracked offline using GPU-accelerated tools like Hashcat. Lava’s analysis found that a third of the captured hashes were recoverable using public wordlists or predictable factory formats. Over 2,340 endpoints had default accounts (e.g., ADMIN or root) with passwords matching common wordlists, often cracked within minutes. Another one in six exposed hosts accepted empty usernames paired with weak passwords.
Vendor-Specific Risks
Supermicro BMCs, prevalent in data centers and GPU infrastructure, were the most common in the dataset. While the company replaced shared default passwords years ago complying with California’s SB-327 its current factory passwords follow a 10-character uppercase alphabetic format, creating a keyspace of ~141 trillion possibilities. Lava demonstrated that eight GPUs could brute-force this in under an hour. Testing two adjacent servers at a U.S. bare-metal GPU provider confirmed both used the sticker-based default passwords; the provider patched the exposure after disclosure.
HPE’s iLO controllers fared worse, using shorter factory passwords (uppercase letters + digits) that an eight-GPU lab system cracked in 32 seconds per hash. One exposed iLO 4 interface displayed a ransom note, suggesting prior compromise possibly via iLOBleed, a rootkit known to persist in iLO firmware and enable destructive attacks.
Impact and Response
BMCs operate below the OS, granting attackers remote power control, firmware flashing, and console access all invisible to host-based security tools. Compromised BMCs can maintain persistence even after system rebuilds, posing severe risks to critical infrastructure, particularly as AI workloads expand.
Supermicro acknowledged the findings in June, reiterating guidance to rotate default passwords and isolate BMCs via VLANs or access controls. The company also plans to review its default password policy for future hardware, potentially introducing longer passwords or expanded character sets.
Mitigation
Network-level protections are critical: blocking UDP port 623 at the perimeter, disabling legacy IPMI 1.5 and weak cipher suites, and replacing factory credentials during provisioning. BMCs should be restricted to dedicated management networks, VPNs, or bastion hosts, with Redfish over TLS used for secure administration. Without these measures, exposed BMCs remain a low-effort target for credential theft and persistent access.
Source: https://www.helpnetsecurity.com/2026/07/28/exposed-bmc-ipmi-vulnerability-research/
Supermicro cybersecurity rating report: https://www.rankiteo.com/company/supermicro
Hewlett Packard Enterprise cybersecurity rating report: https://www.rankiteo.com/company/hewlett-packard-enterprise
"id": "SUPHEW1785248754",
"linkid": "supermicro, hewlett-packard-enterprise",
"type": "Vulnerability",
"date": "1/2013",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Data centers, GPU '
'infrastructure providers',
'industry': 'Technology/Server Hardware',
'name': 'Supermicro',
'type': 'Hardware Vendor'},
{'industry': 'Technology/Server Hardware',
'name': 'HPE (Hewlett Packard Enterprise)',
'type': 'Hardware Vendor'},
{'industry': 'Cloud/GPU Infrastructure',
'location': 'United States',
'name': 'U.S. bare-metal GPU provider',
'type': 'Service Provider'}],
'attack_vector': 'Remote (UDP port 623)',
'data_breach': {'number_of_records_exposed': '24,650 hashes leaked',
'sensitivity_of_data': 'High (password-derived, crackable '
'offline)',
'type_of_data_compromised': 'Authentication hashes '
'(HMAC-SHA1)'},
'description': 'A decade-old vulnerability in baseboard management '
'controllers (BMCs) is leaving tens of thousands of servers '
'exposed to credential theft without detection. Researchers at '
'Lava identified 36,872 publicly accessible BMCs via Shodan, '
'with 24,650 leaking password-derived authentication hashes '
'before any login attempt. The flaw, tracked as CVE-2013-4786, '
'stems from the IPMI 2.0 handshake, which allows attackers to '
'request HMAC-SHA1 hashes over UDP port 623 without '
'authentication. Once obtained, these hashes can be cracked '
'offline using GPU-accelerated tools like Hashcat.',
'impact': {'data_compromised': 'Password-derived authentication hashes '
'(HMAC-SHA1)',
'identity_theft_risk': 'High (offline password cracking leading to '
'unauthorized access)',
'operational_impact': 'Remote power control, firmware flashing, '
'and console access below OS-level security',
'systems_affected': '36,872 publicly accessible BMCs, 24,650 '
'leaking hashes'},
'investigation_status': 'Ongoing (researchers disclosed findings, vendors '
'acknowledged)',
'lessons_learned': 'Default credentials and legacy protocols (IPMI 2.0) pose '
'significant risks. BMCs must be isolated and secured with '
'strong, unique passwords. Vendor default password '
'policies (e.g., Supermicro’s 10-character uppercase '
'format) are insufficient against modern brute-force '
'attacks.',
'post_incident_analysis': {'corrective_actions': ['Supermicro reviewing '
'default password policy '
'for future hardware',
'Vendors recommending '
'isolation of BMCs via '
'VLANs or access controls',
'Customers advised to '
'replace factory '
'credentials and disable '
'legacy protocols'],
'root_causes': ['Legacy IPMI 2.0 protocol flaw '
'(CVE-2013-4786)',
'Weak default passwords (e.g., '
'Supermicro’s 10-character '
'uppercase format, HPE’s shorter '
'alphanumeric format)',
'Publicly accessible BMCs without '
'network segmentation',
'Lack of enforcement for password '
'rotation during provisioning']},
'ransomware': {'ransomware_strain': 'iLOBleed (observed on one HPE iLO 4 '
'interface)'},
'recommendations': ['Block UDP port 623 at the perimeter',
'Disable legacy IPMI 1.5 and weak cipher suites',
'Replace factory credentials during provisioning',
'Restrict BMCs to dedicated management networks, VPNs, or '
'bastion hosts',
'Use Redfish over TLS for secure administration',
'Rotate default passwords and enforce strong, unique '
'passwords',
'Monitor for unauthorized access to BMC interfaces'],
'references': [{'source': 'Lava Research'}, {'source': 'Shodan'}],
'regulatory_compliance': {'regulations_violated': 'Potential non-compliance '
'with California’s SB-327 '
'(default password '
'requirements)'},
'response': {'communication_strategy': 'Vendor acknowledgment (Supermicro), '
'public disclosure by researchers',
'containment_measures': 'Blocking UDP port 623 at the perimeter, '
'disabling legacy IPMI 1.5 and weak '
'cipher suites',
'network_segmentation': 'Restricting BMCs to dedicated '
'management networks, VPNs, or bastion '
'hosts',
'remediation_measures': 'Rotating default passwords, isolating '
'BMCs via VLANs or access controls, '
'replacing factory credentials during '
'provisioning',
'third_party_assistance': 'Lava (security researchers)'},
'stakeholder_advisories': 'Supermicro and HPE advised customers to rotate '
'default passwords and isolate BMCs.',
'title': 'Critical BMC Vulnerability Exposes Thousands of Servers to Offline '
'Password Cracking',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2013-4786 (IPMI 2.0 HMAC-SHA1 handshake flaw)'}