22-year-old BMC flaw puts nearly 37,000 servers at risk

Data-center security firm Lava reported that a 22-year-old design flaw in Baseboard Management Controllers (BMCs) can let unauthenticated attackers obtain password-derived hashes from IPMI implementations. The issue affects BMCs that expose the IPMI protocol on UDP port 623 and allows an attacker to capture an HMAC and test passwords offline.

Lava’s internet scan identified nearly 37,000 IPMI-capable interfaces reachable from the public internet. Of those, more than 24,000 returned password-derived authentication hashes before a login completed. The firm also found 6,240 hosts that accepted an empty username with a weak password and 2,340 hosts that had named accounts such as Admin or root using passwords commonly found in public wordlists. Some devices used predictable factory-issued password formats.

The defect is tracked as CVE-2013-4786 and traces to authentication design choices in the IPMI 2.0 specification introduced in 2004. A NIST advisory cited by Lava describes how a BMC can return an HMAC-SHA1 authentication code calculated from the account password and session values that an unauthenticated requester can know. An attacker who can reach UDP port 623 can request that response and verify password guesses offline.

BMCs run on most server platforms and provide out-of-band management functions that work even when the host operating system is offline. Administrators use BMCs to power-cycle servers, install firmware updates, change low-level platform settings and read hardware sensors. Management access commonly appears through IPMI, the Redfish HTTPS API and web-based consoles. Lava noted, “In many implementations, these interfaces share the same user database. A credential that works for IPMI may also work for the web interface or Redfish API.”

Because the vulnerability enables offline testing of password guesses, attackers do not need to perform repeated online login attempts. Lava highlighted that modern GPU-based cracking tools can recover weak, reused or default passwords quickly. The company warned that predictable factory passwords and limited monitoring of management planes can allow a single exposed BMC to become a high-privilege foothold across a management network.

The flaw has been publicly identified since 2013 but originates in IPMI 2.0 design decisions from 2004. Vendors and system administrators have previously been advised to harden management interfaces and limit exposure of IPMI ports to untrusted networks.