CVE-2013-4786 at 13 years old, 24,650 BMC still expose their IPMI hash before login

Lava scanned the net in May 2026: 36,872 exposed BMC interfaces, including 24,650 that spit out the IPMI hash on a simple RAKP request. A 13-year-old spec flaw, unpatchable, with Supermicro, HPE iLO, and Dell in the front line.

3 h ago 12 3