TL;DR
- what: Researchers at Lava scanned the internet on May 6, 2026 and found 36,872 hosts exposing IPMI on UDP port 623, of which 24,650 return password-derived HMAC-SHA1 authentication material to unauthenticated attackers before login via CVE-2013-4786.
- impact: Over 30% of collected hashes were cracked offline using common wordlists and factory chassis-sticker formats, handing attackers out-of-band control of servers that survives OS reinstalls and sits below every host-based security tool.
- fix: There is no patch because CVE-2013-4786 is a flaw in the IPMI v2.0 specification itself, per Dell's advisory, so the mitigation is blocking UDP 623 at the edge, moving BMCs to an isolated management VLAN, disabling IPMI 1.5, and rotating every factory-issued credential.
- who: Anyone running HPE iLO, Supermicro, or Dell iDRAC baseboard management controllers reachable from the internet, with the sharpest exposure at GPU and bare-metal hosting providers running multi-tenant AI infrastructure.
A scan of the public internet on May 6, 2026 turned up 36,872 unique hosts running the Intelligent Platform Management Interface on UDP port 623. Of those, 24,650 return password-derived authentication material to any unauthenticated party that asks for it. No credentials, no session, no login attempt to rate-limit or log. Security firm Lava, which shared the research with The Hacker News, recovered more than 30% of the collected hashes using common wordlists and predictable factory chassis-sticker password formats. The affected population is not legacy junk sitting forgotten in a closet: it includes modern Supermicro and HPE servers operated by GPU providers, some still running factory-issued passwords.
The numbers
The geographic and outcome breakdown from the scan is what turns this from a known-issue footnote into an operational problem:
- 36,872 unique hosts with IPMI reachable on UDP 623 as of May 6, 2026, with more than 14,000 in the United States and the remainder concentrated in Germany, China, the Netherlands, and the U.K.
- 24,650 of those hosts disclosed password-derived authentication material before login, enabling fully offline credential cracking.
- 6,240 BMCs returned authentication material for an empty username that matched a weak password candidate.
- 2,340 BMCs returned authentication data for a named account such as ADMIN or root matching a password from publicly available wordlists.
- HPE iLO factory passwords were recovered in under a minute on modern GPU hardware; Supermicro factory passwords took roughly one hour despite being uniquely assigned per server.
Why there is no patch
The mechanism is CVE-2013-4786, an information disclosure flaw carrying a CVSS score of 7.5. During the RMCP+ Authenticated Key-Exchange Protocol handshake, the BMC returns a message containing an HMAC-SHA1 authentication code computed from the account password and session values the requester already knows. That is the protocol working as designed. An unauthenticated remote party that can reach UDP 623 requests the RAKP response, captures the HMAC, and then tests password candidates locally at whatever rate its hardware allows.
Dell's advisory on the issue is blunt about the remediation path: this is an inherent problem with the specification for IPMI v2.0, and there is no patch. Every vendor implementing the spec correctly is affected. Supermicro told researchers it will evaluate improvements to its default password policy in future hardware revisions, which does nothing for the fleet already racked. This is a network exposure problem and a credential hygiene problem, not a patching problem, and treating it as the latter is why it has survived since 2013.
The vulnerability didn't change. The economics did. — CVE-2013-4786 has been public for over a decade and was largely written off as low-value because offline cracking was slow and the average exposed BMC fronted a commodity server. Both assumptions have collapsed. Modern GPU cracking rigs chew through HMAC-SHA1 candidates fast enough to break an HPE iLO factory password in under 60 seconds, and the server behind the BMC is now as likely to be a multi-tenant AI training node as a mail relay. Same CVE, radically different payoff.
What a compromised BMC actually gets an attacker
Baseboard management controllers are dedicated management processors soldered onto the motherboard. They control power state, firmware, remote console, OS installation, and system recovery, and they are the backbone of remote data center automation for hardware telemetry, mass firmware rollout, and BIOS configuration. Critically, they run out-of-band: completely independent of the host operating system, powered whenever the chassis has standby power, and invisible to anything running on the host.
That means an attacker with valid BMC credentials sidesteps every host-based control you have deployed. EDR does not see it. Host logging does not see it. Wiping and reimaging the machine does not evict it, because the attacker's access lives beneath the operating system and outlives it. From there the attacker can mount virtual media, alter BIOS settings, flash firmware, and take console. Eclypsium documented BMCs as a persistence target back in 2022 and 2023, and the iLOBleed rootkit has been deploying against HPE iLO since 2020.
The AI data center multiplier
The reason this scan matters more in 2026 than the identical scan would have in 2016 is tenancy. In modern AI and bare-metal hosting environments, one physical chassis routinely serves multiple customers over time or concurrently. A single compromised BMC in that environment is not one victim; it is a foothold into shared infrastructure and a launch point for lateral movement across tenant workloads. Lava's framing is that this is a significant blind spot in the infrastructure underpinning the AI data center buildout, and the presence of factory-default credentials on GPU provider hardware in the scan results supports it. Organizations have spent a decade hardening cloud workloads and operating systems while leaving the layer underneath them on shipping-carton passwords.
Already being targeted
This is not theoretical exposure waiting for someone to notice. Researchers observed evidence of active targeting of internet-exposed BMC interfaces, including a ransomware extortion note left on an HPE iLO 4 login page. Attribution is unclear. It does not need to be: a defaced iLO login page means an attacker reached the interface, authenticated, and had enough control to modify what it displayed. If your BMCs answer on UDP 623 from the open internet, assume the hashes have already been collected and the cracking has already run.
What to do this week
- Scan your own external ranges for UDP 623 and block it at the network edge. This is the single highest-value action and it takes minutes.
- Move all BMC interfaces onto a dedicated, isolated management network with no route to or from the internet, reachable only from approved jump hosts.
- Rotate every factory-issued BMC credential as a mandatory provisioning step, and confirm the rotation actually took on chassis that shipped with per-unit sticker passwords.
- Disable IPMI 1.5 and other legacy or weak authentication options; where the platform supports it, prefer Redfish over HTTPS and turn IPMI off entirely.
- Audit for empty-username and default-named accounts such as ADMIN and root, which accounted for 8,580 of the weak-credential hits in this research.
- Apply network access controls so only named administrative systems can reach BMC interfaces, and alert on any other source touching them.
⚠️ Blocking the port is not the same as fixing the credentials — Filtering UDP 623 at the perimeter removes the internet-facing exposure but leaves every weak or factory-set BMC password intact behind it. Any attacker who lands inside the management network, or any insider with access to it, can run the exact same RAKP hash extraction and offline cracking against your entire fleet in one pass. Treat network isolation and credential rotation as two separate remediation tracks and complete both.
The uncomfortable part of this research is how little of it is new. The CVE is from 2013. The vendor advisories saying no patch exists are years old. What changed is that offline cracking got cheap and the machines behind these controllers got expensive. If your organization has never inventoried its BMCs as an attack surface, that inventory is the work item.
Originally published on RedEye Threat Intelligence.
