CVE-2013-4786: IPMI 2.0 RAKP authentication leaks password hashes to remote attackers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely exploitable without authentication and has very high EPSS, but it requires network access to a BMC and yields hashes rather than direct code execution.

What it is

The IPMI 2.0 specification's RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication allows a remote attacker to obtain password hashes by reading the HMAC from a RAKP message 2 response from a BMC. This is a protocol design flaw, not a simple coding bug, so it affects any IPMI 2.0 implementation that follows the specification. It matters because exposed BMC interfaces are common and the leaked hashes enable offline cracking.

Impact

An attacker gains password hashes for IPMI user accounts, which can be cracked offline to recover plaintext credentials. Those credentials can then be used to access the BMC and potentially the managed host.

Attack surface

Reachable over the network via the IPMI/RMCP+ service, typically UDP port 623 on a BMC. The CVSS vector shows no privileges and no user interaction required, so any host that can reach the BMC interface can trigger the exchange.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.7857, 99.56th percentile), indicating a large volume of observed exploitation activity. Reference material includes a Metasploit-related penetration testing guide, showing public tooling exists.

What to do

• Apply vendor firmware updates for the BMC/IPMI implementation; check Oracle, Intel, Fujitsu, HPE, NetApp and NVIDIA advisories referenced in the record.
• If firmware cannot be updated, disable IPMI 2.0 RMCP+ or restrict IPMI access to a dedicated, isolated management network.
• Use strong, unique, high-entropy IPMI passwords so leaked hashes are impractical to crack offline.
• Block UDP port 623 and other IPMI ports from untrusted networks at the perimeter and between segments.
• Where possible, disable IPMI over LAN or use a more secure out-of-band management path.

Detection

• Monitor network traffic for RAKP message 2 responses from BMCs to unexpected or external source addresses.
• Alert on IPMI/RMCP+ traffic (UDP 623) crossing network boundaries or originating outside the management VLAN.
• Audit BMC logs for repeated authentication attempts or sessions from unusual source IPs.
• Inventory BMC interfaces and flag any that are internet-facing or reachable from general user networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.