IPMI BMCs Leak Password Hashes via Unauthenticated Handshake (CVE‑2013‑4786)
What Happened — Researchers scanning the public Internet identified ≈ 36 k baseboard management controllers (BMCs) that responded to unauthenticated UDP‑623 requests with an HMAC‑SHA1 password hash, a flaw tracked as CVE‑2013‑4786. Roughly two‑thirds of those exposed hashes were recoverable using public wordlists or predictable factory‑issued passwords.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses traditional OS‑level logging, making it a classic “blind‑spot” that SOC 2 access‑control testing must surface and evidence.
- Continuous control monitoring of BMC exposure (network segmentation, firewall rules, credential rotation) provides the audit‑ready proof points required for the CC6.1 Logical Access controls.
- Mapping this misconfiguration to Verisq’s SOC2 Access Controls capability demonstrates that you can collect real‑time evidence of BMC hardening for a defensible SOC 2 audit.
Who Is Affected — Data‑center operators, cloud‑infrastructure providers, GPU‑hosting services, and any organization that runs Supermicro, HPE iLO, or similar BMC‑managed servers.
Recommended Actions
- Inventory all IPMI‑enabled devices and verify they are not reachable from the Internet (network‑level segmentation).
- Apply vendor‑supplied firmware patches that remediate CVE‑2013‑4786 or disable IPMI over UDP where not needed.
- Rotate default factory credentials to strong, unique passwords and store them in a privileged‑access‑management (PAM) vault.
- Incorporate BMC‑access checks into your continuous compliance dashboard to generate audit‑ready evidence of remediation. Source: Help Net Security
Technical Notes
- Attack vector: Unauthenticated UDP‑623 request triggers IPMI 2.0 handshake, returning an HMAC‑SHA1 hash derived from the password.
- CVE: CVE‑2013‑4786 (IPMI authentication bypass).
- Data exposed: Password hashes; up to 1/3 were cracked using public wordlists or predictable 10‑character uppercase factory passwords.
- Affected hardware: Predominantly Supermicro servers; also HPE iLO implementations. Source: Help Net Security