The vulnerability CVE-2013-4786, introduced in 2004 in the IPMI 2.0 authentication protocol, allows an unauthenticated remote attacker to request an HMAC-SHA1 authentication code from a BMC via UDP port 623. This HMAC is calculated using the account password and session values known to the requester, enabling offline password recovery without repeated online login attempts. Lava's research found over 24,000 internet-accessible BMC interfaces exposing these hashes, with many using weak or default passwords. BMCs control critical server management functions, including power cycling and firmware updates, making exploitation a serious threat to data center security. The vulnerability affects implementations sharing user databases across IPMI, Redfish API, and web interfaces. The issue highlights a broader security gap in data center management planes, where BMCs often lack adequate monitoring and protection.

Attackers can obtain password hashes from exposed BMC interfaces and perform offline cracking to recover weak or default passwords. Successful exploitation can grant privileged access to server management functions, potentially allowing attackers to control critical infrastructure components within data centers. This can lead to unauthorized firmware updates, power cycling, and configuration changes. The presence of weak and predictable passwords exacerbates the risk. However, exploitation requires network access to UDP port 623 and offline cracking efforts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official patches or mitigations are available, organizations should restrict network access to UDP port 623 to trusted management networks only and audit BMC accounts for weak, default, or predictable passwords, changing them to strong, unique credentials. Monitoring and protecting BMC interfaces should be prioritized given their critical role in infrastructure management.