24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Researchers have identified over 24,650 internet-exposed Baseboard Management Controllers (BMCs) that expose password-derived authentication hashes before login due to a flaw in the IPMI v2.0 specification. This vulnerability, tracked as CVE-2013-4786">CVE-2013-4786, allows attackers to retrieve HMAC values from RAKP messages and perform offline brute-force attacks against server credentials. The issue affects BMCs used in Dell Data Domain, Supermicro, and HPE servers. Despite being known since 2013, the flaw remains unpatched because it stems from the IPMI v2.0 standard itself. Security experts warn that exposed BMCs pose a serious risk, especially in AI data centers where shared infrastructure increases potential attack surfaces.