Supermicro BMC (IPMI)

CVE-2013-4786, 24,650 internet-exposed BMCs hand a crackable password hash to any unauthenticated caller, and Lava found ransom notes on live management interfaces

Background. The flaw at the centre of this research is not new. CVE-2013-4786 was assigned in 2013 and the weakness it describes has been in the IPMI 2.0 specification since that standard shipped in 2004 (Lava, 2026-07-29). The management layer it exposes has drawn attacker attention before: Lava cites prior public research on iLOBleed, a persistent iLO 4 rootkit associated with destructive attacks, as precedent for adversary interest in this layer (Lava, 2026-07-29). What is new is the measured scale of exposure thirteen years after disclosure, and evidence that it is being used.

A baseboard management controller is the dedicated, OS-independent processor on a server motherboard that provides out-of-band control (power, reboot, virtual media, firmware, health telemetry) over IPMI or the newer Redfish API. Control of a BMC is therefore control of the machine beneath any operating system on it. Lava queried Shodan for hosts answering on UDP/623 and found "36,872 unique hosts exposing IPMI to the public internet" on 2026-05-06, observing roughly sixty previously-unseen addresses newly exposing IPMI each day between May and July (Lava, 2026-07-29).

The exploitation primitive is a single unauthenticated request. The client sends a RAKP Message 1 naming the account it wants; the controller replies in RAKP Message 2 with an HMAC-SHA1 computed over that account's password, before the client has authenticated (Lava, 2026-07-29). Lava found that "approximately two-thirds of the exposed BMCs we tested returned at least one password-derived authentication hash before client authentication was complete", 24,650 of the 36,872 hosts (Lava, 2026-07-29). Two further slices of that population needed no cracking effort at all: 6,240 hosts accepted an empty username paired with a password that matched a common wordlist, and 2,340 had a named account such as ADMIN or root whose password matched a wordlist (Lava, 2026-07-29).

What makes this materially worse than an ordinary weak-credential finding is that the hash is returned per request rather than per authentication attempt, so guessing happens entirely offline. No lockout triggers, no rate limit applies, and no failed-login entry is written on the controller. That property also disposes of the obvious detection idea: BMC authentication logs cannot surface this technique, because the attacker never attempts a login there.

Vendor factory-password schemes are the second half of the problem, because their formats are constrained enough to exhaust. Supermicro replaced its old shared ADMIN:ADMIN credential in November 2019 with a unique password printed on the chassis sticker, but the format is exactly ten uppercase letters; Lava puts that keyspace at "26^10, or approximately 141 trillion possible passwords" and assesses that "on a modern server with eight GPUs running Hashcat, the complete candidate space could be searched in approximately one hour" (Lava, 2026-07-29). HPE iLO's factory format is eight characters of uppercase letters and digits, a keyspace roughly fifty times smaller, and on Lava's own eight-GPU lab server "the same search took approximately 32 seconds per response" (Lava, 2026-07-29). A unique-per-chassis factory password is not a defence when its format is public and its length is fixed.

This is being abused now, not hypothetically. Lava reports that "during our research, we found an exposed HPE iLO 4 login page displaying a ransom note in its Security Notice panel," claiming the server's data had been encrypted and demanding 0.3 BTC (Lava, 2026-07-29); Lava could establish that the management interface had been accessed and altered by an unauthorised party, not that the underlying data was in fact encrypted. Separately, Lava's CTO told Dark Reading that "during the research, we identified compromised systems belonging to one of the world's largest automotive component manufacturers," with multiple exposed servers displaying ransom notes and payment demands (Dark Reading, 2026-07-28).

Migrating to Redfish does not by itself resolve this. The RAKP weakness is specific to the legacy IPMI 2.0 handshake, but Lava notes that in many implementations the interfaces share one user database, so a password recovered through IPMI often authenticates directly against the web UI or the Redfish API; its guidance is to "prefer Redfish over TLS within an isolated management network. Neither Redfish nor IPMI should be exposed directly to the public internet" (Lava, 2026-07-29). Supermicro, responding to Lava's June 2026 disclosure, accepted that the cracking scenario is plausible with modern multi-GPU hardware, restated its guidance to rotate default passwords at setup and keep management networks off the public internet, and said it would review longer passwords and a wider character set for future hardware (Lava, 2026-07-29).

Detection has to move to the network, because the controller is structurally blind here. The only viable telemetry is network-flow and firewall logging of inbound UDP/623 from outside the management network; the platform-firmware layer is also where recovery gets expensive, since Lava flags that persistence at this level can survive operating-system reinstallation and disk replacement. Hardening is exposure removal first; Lava's own summary is that "the main fix is simple: IPMI should not be reachable from the public internet" (Lava, 2026-07-29), followed by replacing factory credentials during provisioning, disabling IPMI 1.5, cipher-suite-0 and anonymous or NONE authentication, and confining controller access to a dedicated management network reached through a bastion.

Triage: legitimate BMC traffic originates inside a known management VLAN from a small set of administrative hosts. An inbound UDP/623 session from a WAN-facing or unrecognised source is not merely suspicious but inherently anomalous, since there is no benign reason for an out-of-band management controller to answer the public internet; and because the disclosure step generates no authentication event, the absence of suspicious BMC login entries is not evidence that nothing happened.