24,000 exposed BMCs leak hashes: close your IPMI port
A 2004 protocol flaw with no patch is handing out password hashes from 24,000 internet-exposed server BMCs. The fix is network exposure, not a firmware update.
Most security work this month has been about patching fast. This one you can't patch. IPMI password hash disclosure is a design flaw in a 2004 protocol, there is no fix coming, and new scan data says more than 24,000 internet-exposed server baseboard management controllers are handing out crackable hashes to anyone who asks.
What actually happened
Researchers at the infrastructure security startup Lava scanned the internet for exposed management interfaces and found 36,872 IPMI-reachable hosts, of which over 24,000 leak authentication password hashes on request, BleepingComputer reported on July 28. The United States accounts for 39% of the vulnerable population. Vendors were notified in June 2026.
The underlying issue is CVE-2013-4786, and the date in that identifier is not a typo. IPMI v2.0's RAKP key-exchange handshake returns an HMAC computed over the account's password hash before authentication completes. Send a request to UDP 623 with a valid username, get back material you can crack offline at your leisure. Tenable's writeup is blunt about the remedy: there is no patch, because "it is an inherent problem with the specification for IPMI v2.0." Rapid7 shipped a Metasploit module for it over a decade ago.
What makes the new numbers worse than the old ones is what the hashes protect. Some Supermicro boards ship with a factory password printed on the chassis label — ten uppercase characters, which is a short, known-alphabet target for a modern cracking rig. HPE iLO 4 systems showed up in the exposed set too. If the factory credential was never rotated, the offline crack is a formality.
Why an exposed management port matters for your business
A BMC is not another service on the server. It is the small always-on computer underneath the server, with power control, virtual media, and console access that work whether the operating system is running, patched, wiped, or on fire. Whoever cracks that hash doesn't get a shell on your app. They get the ability to mount an ISO and reinstall the box.
Here's why this lands on small operators specifically: nobody buys a BMC. You get one bundled with a colo box, a rented bare-metal server, or the hypervisor an MSP racked for you three years ago. It was configured once, during a build, by someone optimizing for "can I reach this remotely if it dies at 2am." That convenience decision is still running.
So the action item isn't a patch cycle, it's an exposure audit. Ask your host or MSP three questions in writing: is the management interface reachable from the public internet, has the factory BMC password been rotated, and is legacy IPMI authentication still enabled alongside Redfish. Then verify rather than trust — a scan of your own public IP ranges for UDP 623 and the iLO/IPMI web ports takes an afternoon and settles the question permanently. The durable fix is the boring one we recommend after every management-plane story: out-of-band interfaces belong on an isolated network behind a VPN, reachable by a named list of people, and by nothing else.
Key takeaways
- Over 24,000 of 36,872 internet-exposed IPMI hosts leak password hashes pre-authentication; 39% are in the US
- CVE-2013-4786 has no patch — it is inherent to the IPMI v2.0 RAKP handshake, and public exploit tooling has existed for years
- Factory BMC passwords printed on chassis labels are short and known-alphabet, which makes the offline crack trivial
- A compromised BMC means power control, virtual media, and console access independent of the OS — worse than an app-level breach
- Fix the exposure, not the firmware: isolated management network, VPN access, rotated credentials, legacy IPMI auth disabled
Do you know what your infrastructure exposes to the internet? We audit the boxes and interfaces small businesses inherit from hosts and MSPs — management ports, orchestrators, hypervisors, forgotten admin panels — and hand you a map with owners attached. Book an exposure audit or see how we harden small-business infrastructure.
Sources: BleepingComputer, Tenable — IPMI v2.0 Password Hash Disclosure, Rapid7 Metasploit module.
- #ipmi
- #bmc
- #server-security
- #cve-2013-4786
- #network-exposure
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Qualcomm's price increase hits your hardware budget
Qualcomm told customers of a double-digit price increase on chips shipped after September 1. The AI buildout is now repricing hardware that has nothing to do with AI.
Read itDysphoria IoT botnet: your office camera is the recruit
The Dysphoria botnet spreads via weak Telnet and SSH passwords and old router flaws, and resolves its C2 through blockchain domains. Audit your edge gear.
Read it