CVE-2013-4786Active Exploitation(intel / fujitsu_m10_firmware)

HIGHCVSS 7.5 · HIGH

Exploitation observed; activity peaked at 8 mentions and remains active

Immediate actions

Patch intel fujitsu_m10_firmware systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

intel CVEs Back to dashboard

6.3/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-255

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

fujitsu_m10_firmware
intelligent_platform_management_interface

Threat summary

Active exploitation appears in 10 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
21 mentions across 8 observed days

What's happening

Active exploitation reported across 10 signals
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 6 signals
Technical details provided in 19 signals
Disclosure: 6 classified signals
Peaked 6d ago at 8 mentions (2026-07-29); latest day: 1
21 total mentions across 8 days

Affected systems

Vendors

intel oracle

Products

fujitsu_m10_firmwareintelligent_platform_management_interface

1 version affected across 2 products

Deep dive

Activity timeline21 mentions / 8d

Signal classification4 categories

Active Exploitation

942.9%

Disclosure

628.6%

Patch

314.3%

General

314.3%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-28	6	Active Exploitation3Disclosure2Patch1
2026-07-29	8	Active Exploitation3Disclosure2General1Patch2
2026-07-30	2	Active Exploitation1General1
2026-08-01	1	Disclosure1
2026-08-03	1	Active Exploitation1
2026-08-06	1	General1
2026-08-07	1	Disclosure1
2026-08-13	1	Active Exploitation1

Full discourse20 posts

Xavier Rivera@XavierRiveraX92d
Active Exploitation
More than 24,000 internet-exposed servers leak BMC password hashes via CVE-2013-4786, a 20-year-old IPMI 2.0 flaw. Researchers cracked a third using dictionary attacks on factory-sticker credentials, warning recovered passwords often work across other management interfaces too.
Post summary
CVE‑2013‑4786 is actively exploited across more than 24,000 internet‑exposed servers, leaking BMC password hashes that often work across other management interfaces.
00062380
605 followersView on X
Ronnie Tokazowski@iHeartMalware76d
Active Exploitation
I've said this before and I'll say it again: patch your systems. CVE-2013-4786 still leaks a pre-auth HMAC-SHA1 of the password on 66.9% of 36,872 exposed IPMI services. Factory passwords crack in an hour. https://api.cyfluencer.com/s/how-we-hacked-thousands-of-data-centers-in-minutes-using-a-20-year-old-vulnerability-28959/1
Post summary
The post confirms CVE‑2013‑4786 is still actively exploited, leaking password digests in a majority of exposed IPMI services and prompting users to patch immediately to avoid quick cracking.
01012183
6.0K followersView on X
Günter Born@etguenni88d
Disclosure
Jemand einen #Server mit #BMC im Einsatz, der per Internet erreichbar ist? Im vom BMC-Interface verwendeten IPMI 2.0-Protokoll gibt es eine Authentifizierungsschwachstelle (CVE-2013-4786). In Deutschland sind ~3.200 Systeme betroffen. https://borncity.com/blog/2026/08/01/mehr-als-24-000-server-mit-bmc-per-schwachstelle-cve-2013-4786-gefaehrdet/
Post summary
The post highlights a known authentication flaw (CVE-2013-4786) in BMC IPMI 2.0, noting about 3,200 affected systems in Germany, but offers no exploit or patch details.
12010446
2.7K followersView on X
Daily CyberSecurity@Daily_CyberSec86d
Active Exploitation
LAVA found 36,872 exposed BMCs leaking IPMI password hashes via CVE-2013-4786. Some are already exploited in the wild. Here is how to lock them down. #BMC #IPMI #CVE20134786 #DataCenter #Supermicro #CyberSecurity http://securityonline.info/exposed-bmcs-cve-2013-4786/
Post summary
The post reports 36,872 exposed BMCs with CVE-2013-4786, notes that some are already exploited in the wild, and links to guidance on securing them.
01020510
13.0K followersView on X
セキュリティ対策Lab@securityLab_jp90d
General
2万4,650台のサーバー管理用 BMCがパスワードハッシュを露出、IPMI 2.0の脆弱性 CVE-2013-4786を再調査 https://rocket-boys.co.jp/security-measures-lab/bmc-ipmi-cve-2013-4786-hash-exposure/ #セキュリティ対策Lab #security #securitynews #cyberattack #incident #脆弱性
Post summary
The article reports a re‑investigation of CVE‑2013‑4786, noting password‑hash exposure in BMCs, but provides no PoC, exploit code, active exploitation evidence, or patch information.
01020317
683 followersView on X
Dawood Sajjadi@5tuxnet81d
Disclosure
HD Moore found a dozen-plus new BMC flaws across HPE, Supermicro, Avocent, Huawei, Lenovo and Dell. His scan found 86,000 BMCs exposed to the internet, up to 75,000 still vulnerable to CVE-2013-4786 — a 13-year-old IPMI 2.0 bug that leaks admin password hashes for offline cracking. Over half the exposed population had at least one critical flaw; 29% of 126,761 BMCs surveyed inside corporate networks did too. The new classes include auth handshakes you can reorder to skip authentication, plus unsigned firmware and unenforced config integrity that turn admin access into a permanent implant below the OS — as ILObleed demonstrated in 2021 with wiper firmware that survived OS reinstalls and drive swaps. https://www.runzero.com/blog/bmc-research/
Post summary
A research report identified dozens of new back‑end management interface flaws, including authentication bypass and firmware tampering, across several vendor lines, providing detailed technical characteristics but no evidence of exploitation or available patches.
00020491
7.9K followersView on X
كاسبر سكاي@KasperskyDev90d
Active Exploitation
أكثر من ٢٤ ألف خادم يُسرّب هاش كلمة المرور قبل المصادقة عبر ثغرة بروتوكول إدارة عمرها ٢٠ عاماً. الثغرة : CVE-2013-4786 (IPMI 2.0) عدد الخوادم : 24,650 internet-exposed الحل : Block UDP/623 — change default BMC passwords #IPMI #CyberSecurity
Post summary
CVE‑2013‑4786 is actively exploited on over 24,650 internet‑exposed IPMI servers, leaking password hashes; mitigation involves blocking UDP/623 and updating default BMC passwords.
11000254
39.9K followersView on X
CyberTLDR@CyberTLDR91d
Disclosure
2/3 CVE-2013-4786 (CVSS 7.5) abuses the IPMI 2.0 RAKP handshake, which returns a password hash for any username during auth. Attackers grab the hash and crack it offline, no login needed. #InfoSec #CVE #Cyber
Post summary
CVE-2013-4786 enables attackers to capture a password hash during IPMI 2.0 authentication, which can be cracked offline without requiring a successful login.
1000025
37 followersView on X
Zero Hunt@zerohuntai91d
Patch
The fix, honestly: - CVE-2013-4786: nothing. Ever. It's the specification. - Patchable: BMC firmware — closes CVE-2024-3411 (9.1), not the RAKP leak. - Actual removal: move to Redfish, disable IPMI-over-LAN. No lockout applies. Every guess runs on their GPU, not yours.
Post summary
The message confirms that a BMC firmware patch addresses CVE‑2024‑3411 and recommends disabling IPMI‑over‑LAN and moving to Redfish, while also stating CVE‑2013‑4786 is not a real vulnerability.
1000035
12 followersView on X
Zero Hunt@zerohuntai91d
General
24,650 of 36,872 internet-exposed BMCs return a password-derived HMAC-SHA1 to anyone who reaches UDP 623 — before authentication. CVE-2013-4786 isn't a vendor bug. It's in the IPMI 2.0 spec, published 2004. There is no fixed version. There never will be. https://t.co/zZPB3hokxX
Post summary
The tweet details that many IPMI BMCs expose a password-derived HMAC over UDP 623 pre-authentication, noting the CVE‑2013‑4786 vulnerability is part of the IPMI spec and has no patch, but offers no PoC, exploit, or active attack report.
1000031
12 followersView on X
Pierson-Tech@Pierson_Tech91d
Patch
@TheHackersNews This is a management-plane exposure problem, not a new CVE. If UDP/623 is internet-reachable, CVE-2013-4786 can expose password-derived material for offline cracking. Block public IPMI, isolate BMCs, rotate factory credentials, and disable anonymous/NONE auth.
Post summary
The post highlights that CVE‑2013‑4786 can expose password‑derived data if IPMI (UDP/623) is reachable and urges administrators to block public IPMI access, isolate BMCs, rotate default credentials, and disable anonymous authentication as mitigation.
0000145
53 followersView on X
Ing. Stgo. Diaz@Smarteck_cl82d
General
🔓 SecurityWeek reportó que 24.650 controladores de gestión de servidores en internet siguen filtrando hashes de autenticación antes de que nadie inicie sesión, por un bug de hace 13 años. La causa es CVE-2013-4786, una debilidad en el protocolo IPMI 2.0 que casi dos tercios de los 36.872 hosts escaneados en el puerto UDP 623 siguen exponiendo. Los hashes HMAC-SHA1 derivados de contraseña se pueden crackear offline sin dejar rastro en los logs del equipo afectado. Quieres conocer más novedades tecnológicas? Sigue a @smarteck_cl y guarda, para tus futuras referencias. #BMC #IPMI #Ciberseguridad https://www.securityweek.com/decades-old-bmc-vulnerability-exposes-thousands-of-data-centers-to-attacks/
Post summary
The post reports that thousands of servers still expose authentication hashes due to the long‑standing CVE‑2013‑4786 flaw in IPMI 2.0, providing technical details but no PoC, exploit code, active exploitation evidence, or patch information.
0000038
1.9K followersView on X
Julio Bandeira de Melo@juliobmelo90d
Active Exploitation
A flaw introduced with the IPMI 2.0 protocol in 2004 still exposes 24,000 server management controllers to takeover. Lava Research found CVE-2013-4786 allows attackers to extract password hashes from exposed BMCs without authentication, and they discovered ransomware notes on compromised controllers belonging to a major automotive manufacturer. The BMC operates below the OS and outside the view of most security tools. If your data center management interfaces are on the public internet, assume they are compromised. https://www.darkreading.com/cyber-risk/flaw-exposes-data-centers-server-takeover #InfrastructureSecurity
Post summary
CVE‑2013‑4786 continues to expose roughly 24,000 BMCs, enabling attackers to extract password hashes and enabling ransomware attacks on an automotive manufacturer’s servers—demonstrating that exposed management interfaces are being actively exploited.
00000239
48.8K followersView on X
Aviatrix Threat Research Center@aviatrixtrc90d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2013-4786 to harvest password hashes from 24,000+ exposed BMCs, then using offline brute-force attacks to compromise data center servers. This attack path highlights how legacy out-of-band management creates persistent lateral movement risks across infrastructure. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/flaw-exposes-data-centers-server-takeover-cve-2013-4786
Post summary
TRC analysis confirms real-world exploitation of CVE-2013-4786, with attackers harvesting BMC password hashes and leveraging offline brute force to compromise servers, highlighting lateral movement risks.
0000042
1.9K followersView on X
CyberWatch@CyberWatch0591d
Disclosure
JUST IN: A 22-year-old IPMI 2.0 flaw (CVE-2013-4786) lets attackers grab password-derived hashes from ~24,650 publicly exposed BMC interfaces without logging in — enabling offline cracking of weak and factory default credentials on thousands of servers.
Post summary
The 22‑year‑old IPMI 2.0 flaw (CVE‑2013‑4786) enables attackers to download password‑derived hashes from publicly exposed BMC interfaces, facilitating offline cracking of weak or default credentials.
00000160
529 followersView on X
Zero Hunt@zerohuntai91d
Patch
Hunt before you call it clean: virtual-media mounts and console sessions in the iDRAC LC / iLO IML logs. T1542.001 — implants like iLOBleed survive a full OS reinstall. No patch means the compensating control IS the evidence. Full runbook: https://zerohunt.ai/blog/bmc-ipmi-cve-2013-4786-password-hash-exposure/#remediation
Post summary
The post highlights the lack of a patch for CVE‑2013‑4786 and directs readers to a remediation runbook, indicating that mitigation steps are available but active exploitation continues.
0000020
12 followersView on X
Aviatrix Threat Research Center@aviatrixtrc91d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2013-4786 to harvest password hashes from over 24,000 exposed BMC interfaces. This decades-old IPMI flaw enables offline credential cracking and hardware-level control. Runtime segmentation of management networks helps contain such infrastructure compromises. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/over-24000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw
Post summary
CVE‑2013‑4786 is being actively exploited to harvest password hashes from a large set of exposed BMC interfaces, as reported by TRC analysis, with technical details outlined but no patch or workaround discussed.
0000035
1.9K followersView on X
Cybersecurity News Everyday@TweetThreatNews91d
Disclosure
36,000+ internet-exposed BMCs were found running IPMI, and nearly 25,000 leaked password hashes before login due to CVE-2013-4786. Offline cracking could expose weak or factory-set passwords. #IPMI #BMC #HPEiLO https://www.hendryadrian.com/24650-internet-exposed-bmcs-disclose-ipmi-password-hashes-before-login/
Post summary
The post reports a large-scale discovery of internet-exposed BMCs running IPMI, revealing that CVE-2013-4786 allows pre-login password hash leakage, which can be cracked offline.
00000193
4.5K followersView on X
CyberAlertsHQ@CyberAlertsHQ91d
Active Exploitation
Over 24,650 internet-exposed server BMCs are leaking password hashes via a 20-year-old IPMI flaw (CVE-2013-4786) — a third crackable via dictionaries or default creds. Attackers gain low-level control: firmware updates, power cycling, even multi-tenant AI infrastructure. One exposed HPE iLO instance already displays a ransom note demanding 0.3 BTC. US leads exposure at 39%. https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/
Post summary
A highly sensitive 20‑year‑old IPMI flaw (CVE‑2013‑4786) is actively exploited, with at least one HPE iLO instance used as a ransom demand platform. The widespread exposure underscores the immediate risk to over 24,000 internet‑exposed servers.
0000040
104 followersView on X
TECHEPAGES@techepages91d
Disclosure
24,000+ Server BMCs Exposed by CVE-2013-4786 Over 24,000 internet-exposed server BMCs are leaking password hashes thanks to a 20-year-old IPMI 2.0 flaw (CVE-2013-4786). Researchers at Lava cracked roughly a third of them using dictionary attacks and known factory-sticker password patterns. BMC access can mean full control over physical servers — firmware, power, virtual media — often invisible to normal security tools.
Post summary
The article discloses that CVE-2013-4786 causes over 24,000 BMCs to leak password hashes, with researchers cracking a third of them via dictionary attacks, but provides no PoC, exploit, or patch information.
0000017
35 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	intel	intelligent_platform_management_interface	2.0	-	-
OS	oracle	fujitsu_m10_firmware	-	-	-

Explore more

Back to dashboard intel CVEs oracle CVEs fujitsu_m10_firmware vulnerabilities

What researchers are saying

CVE-2013-4786

Xavier Rivera[verified]@XavierRiveraXActive Exploitation

CVE‑2013‑4786 is actively exploited across more than 24,000 internet‑exposed servers, leaking BMC password hashes that often work across other management interfaces.

セキュリティ対策Lab[verified]@securityLab_jpGeneral

The article reports a re‑investigation of CVE‑2013‑4786, noting password‑hash exposure in BMCs, but provides no PoC, exploit code, active exploitation evidence, or patch information.

Dawood Sajjadi[verified]@5tuxnetDisclosure

A research report identified dozens of new back‑end management interface flaws, including authentication bypass and firmware tampering, across several vendor lines, providing detailed technical characteristics but no evidence of exploitation or available patches.

Pierson-Tech[verified]@Pierson_TechPatch

The post highlights that CVE‑2013‑4786 can expose password‑derived data if IPMI (UDP/623) is reachable and urges administrators to block public IPMI access, isolate BMCs, rotate default credentials, and disable anonymous authentication as mitigation.

Ing. Stgo. Diaz[verified]@Smarteck_clGeneral

The post reports that thousands of servers still expose authentication hashes due to the long‑standing CVE‑2013‑4786 flaw in IPMI 2.0, providing technical details but no PoC, exploit code, active exploitation evidence, or patch information.

Julio Bandeira de Melo[verified]@juliobmeloActive Exploitation

CVE‑2013‑4786 continues to expose roughly 24,000 BMCs, enabling attackers to extract password hashes and enabling ransomware attacks on an automotive manufacturer’s servers—demonstrating that exposed management interfaces are being actively exploited.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

TRC analysis confirms real-world exploitation of CVE-2013-4786, with attackers harvesting BMC password hashes and leveraging offline brute force to compromise servers, highlighting lateral movement risks.

CyberWatch[verified]@CyberWatch05Disclosure

The 22‑year‑old IPMI 2.0 flaw (CVE‑2013‑4786) enables attackers to download password‑derived hashes from publicly exposed BMC interfaces, facilitating offline cracking of weak or default credentials.