CVE-2013-4786 at 13 years old, 24,650 BMC still expose their IPMI hash before login

Lava scanned the net in May 2026: 36,872 exposed BMC interfaces, including 24,650 that spit out the IPMI hash on a simple RAKP request. A 13-year-old spec flaw, unpatchable, with Supermicro, HPE iLO, and Dell in the front line.

The facts

The Lava firm, with researcher Michael Katchinskiy, published on July 28, 2026 a global scan of BMC (Baseboard Management Controller - the out-of-band administration chip present on most servers, such as Supermicro IPMI, HPE iLO, Dell iDRAC) interfaces.

Raw figures, campaign dated May 6, 2026:

• 36,872 BMCs exposed to the internet and speaking IPMI
• 24,650 of them (≈ 67%) respond to the RAKP (RMCP+ Authenticated Key-Exchange Protocol) protocol and disclose an HMAC hash of the password without authentication
• 6,240 accept sessions with an empty username and a weak password
• 2,340+ expose hashes corresponding to public dictionaries (accounts ADMIN, root)
• > 30% of the recovered hashes match factory password patterns

Distribution: more than 14,000 in the United States, the rest concentrated in Germany, China, the Netherlands, and the United Kingdom.

The analysis - a spec flaw, not a bug

This is not a new vulnerability. It is CVE-2013-4786 (CVSS 7.5), documented for 13 years. The problem lies in the IPMI 2.0 specification itself: the RAKP protocol was designed to allow an unauthenticated client to test passwords offline - it's a design property, not an implementation error.

Concretely: an attacker sends a RAKP Message 1 request on UDP/623, the BMC responds with a RAKP Message 2 that contains an HMAC(password, data). The attacker leaves with this HMAC and cracks the password on their own hardware, never contacting the target again - therefore without rate limit, without lockout, without log.

Dell wrote it in black and white in their advisories: « an inherent problem with the specification ». There will be no patch, because there is nothing to patch on the vendor side. Lava indicates that Supermicro factory passwords are cracked in ~1 hour on standard hardware, those of HPE iLO in minutes.

What this changes

A compromised BMC = full-root on the physical server, with KVM access, power control, remote ISO mounting. It's the worst type of access you can give to an attacker. The fact that 24,650 BMCs are still accessible from the internet in 2026, many with factory passwords, is a figure to be taken seriously - especially at a time when ransomware campaigns are explicitly targeting out-of-band admin layers.

American concentration (>14,000): a strong signal on the side of historical data centers, colocation, and mid-market hosts who have forgotten port 623 from their ACL.

What to do now

Box - to do now

• Never expose UDP/623 to the internet. Period. It's a firewall decision, not a BMC configuration.
• Isolate the BMC network on a dedicated VLAN, accessible only via bastion/VPN.
• Change all factory passwords, enforce strong passwords (>16 random characters - the RAKP HMAC is cracked, might as well give it trouble).
• Disable cipher suite 0 (null auth) and RAKP when the vendor allows it (Redfish HTTPS remains preferable to legacy IPMI).
• Audit with ipmitool -I lanplus from an internal scanner to detect forgotten BMCs.

The real task is not to patch IPMI - it's to accept that IPMI has nothing to do facing the internet.