Full Report
Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to
Analysis Summary
# Vulnerability: Remote Information Disclosure in IPMI v2.0 (RAKP Hash Disclosure)
## CVE Details
- **CVE ID:** CVE-2013-4786
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-200 (Information Exposure) / CWE-319 (Cleartext Transmission of Sensitive Information)
## Affected Systems
- **Products:** Various Baseboard Management Controllers (BMCs) including Dell, Supermicro, HPE, and hardware used by GPU providers.
- **Versions:** All hardware implementing the **IPMI v2.0 specification** (introduced Feb 2024 citation in article refers to recent findings, though the spec is vintage).
- **Configurations:** Systems with the Intelligent Platform Management Interface (IPMI) exposed to the public internet, specifically over UDP port 623.
## Vulnerability Description
The vulnerability is an inherent flaw in the IPMI v2.0 specification's RMCP+ Authenticated Key-Exchange Protocol (RAKP). During the authentication process, the BMC sends an HMAC-SHA1 authentication code to the requester before the user has actually authenticated. This HMAC is calculated using the account password. An unauthenticated remote attacker can request this response and then perform an **offline brute-force or dictionary attack** to crack the password hash without triggering account lockouts or further interacting with the BMC.
## Exploitation
- **Status:** Widely exploited/identifiable in the wild; over 24,650 hosts currently found leaking hashes. PoC methods (such as using Metasploit or IPMItool) are decades-old and publicly available.
- **Complexity:** Low
- **Attack Vector:** Network (UDP Port 623)
## Impact
- **Confidentiality:** High (Full Disclosure of administrative credentials)
- **Integrity:** High (Complete remote control over server hardware, firmware, and OS)
- **Availability:** High (BMCs allow remote power cycling and system wipes)
## Remediation
### Patches
- **No Path Available:** Because this is an inherent flaw in the IPMI v2.0 protocol specification, there is no official patch that "fixes" the protocol while maintaining compliance with the v2.0 standard.
### Workarounds
- **Network Isolation:** Move BMC management interfaces to a dedicated, private Management VLAN (Out-of-Band management) that is not reachable from the public internet.
- **Access Control Lists (ACLs):** Restrict access to UDP port 623 to specific authorized administrative IP addresses.
- **Strong Passwords:** Use long, complex passwords (20+ characters) to make offline cracking computationally infeasible. Avoid factory-default credentials.
- **Disable IPMI over LAN:** If remote management via IPMI is not required, disable the IPMI-over-LAN feature entirely via the BMC settings or BIOS.
- **Use Modern Alternatives:** Transition to more secure management protocols like Redfish where available.
## Detection
- **Indicators of Compromise:** Unusual authentication logs or numerous RAKP exchange requests from unknown external IPs.
- **Detection Methods and Tools:**
- Scan for open **UDP Port 623**.
- Use specialized security tools (like `ipmitool` or `nmap` scripts) to check for RAKP support and hash disclosure.
- Monitor for factory-default account names (e.g., `ADMIN`, `root`) in conjunction with IPMI traffic.
## References
- **Vendor Advisory (Dell):** hxxps://www[.]dell[.]com/support/kbdoc/en-us/000222162/data-domain-ipmi-v2-0-password-hash-disclosure
- **NVD Entry:** hxxps://nvd[.]nist[.]gov/vuln/detail/CVE-2013-4786
- **Original Research (Lava):** hxxps://lavahq[.]io/research/bmc-exposure-alert