CVE-2013-4786

nvd.nist.gov • July 29, 2026

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 24,000 Servers Expose Password Hashes via BMC Vulnerability A significant vulnerability in Baseboard Management Controllers (BMCs) has been identified, exposing over 24,000 servers to the internet. This exposure is due to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol, allowing attackers to retrieve password hashes before login. Researchers from Lava found that 36,872 BMC interfaces were publicly accessible, with 24,650 leaking authentication hashes that could be cracked offline. Many of these servers, particularly from Supermicro and HPE, are still using weak or default passwords, making them easy targets. The compromised BMCs can provide attackers with extensive control over the servers, enabling them to execute malicious actions beneath the visibility of traditional security measures. The issue is exacerbated in environments with poor segmentation, potentially affecting multiple tenants simultaneously. Immediate action is recommended to secure these vulnerable systems. 13 sources 74

Extracted Entities

CVE-2013-4786

The full story

Extracted Entities

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)