IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking 1. Basic Information Article Title : Over 24,000 exposed server BMCs leak password hash via decades-old flaw Publisher : BleepingComputer Publication Date : July 28, 2026 Original Source : https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ Related Sources : Lava research (linked in original), CVE-2013-4786 Related Entities : CVE-2013-4786, IPMI 2.0, BMC, Supermicro, HPE iLO 4, UDP/623, GPU/AI servers Severity : High 2. Executive Summary Attackers can send an authentication request to exposed IPMI/BMC interfaces on the internet and receive a password-derived response. They can crack this response offline using GPUs to gain server management privileges that sit below the operating system. A recent scan found 24,650 devices leaking authentication material, with 2,340 using weak, dictionary-based administrator passwords. 3. Attack Flow Scan the internet for IPMI 2.0 services on UDP/623. Start an RMCP+/RAKP authentication handshake with the BMC. Obtain the password-derived authentication response without credentials. Perform offline cracking using dictionaries, default ADMIN users, and vendor-generated password rules. Log in to the BMC using the recovered password. Control power, virtual media, firmware, and low-level settings. Reuse the same credentials on other management interfaces. Inference : Use virtual media or boot settings to compromise the OS, establish persistence, and move laterally across the management network. 4. Attacker Position and Execution Location Attackers connect to UDP/623 from the internet or a reachable management network. Hash cracking happens on the attacker's GPU/CPU, avoiding failed login alerts on the target system. Post-compromise actions run on the BMC processor, which is independent of the OS. 5. Visibility for Victims and Administrators The OS, EDR, and host logs may not show