CVE-2013-4786

HIGH

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

CVSS v3.1 Score

7.5
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Published: 7/8/2013Modified: 6/16/2026

Related Intelligence (1)

CRITICALVulnerability

A 13-year-old flaw is exposing tens of thousands of data center management systems

The ‘no man’s land’ beneath the OS on enterprise servers is becoming the malicious actors’ next target. Attackers are gaining a foothold into broader data center environments by exploiting Baseboard Management Controllers (BMCs) that are largely unprotected, still running decades-old protocols and susceptible to a vulnerability published 13 years ago, according to data center security company Lava

CVE-2013-4786
CSO Online

References (14)

http://fish2.com/ipmi/remote-pw-cracking.htmlhttp://marc.info/?l=bugtraq&m=139653661621384&w=2http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttps://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmihttps://nvidia.custhelp.com/app/answers/detail/a_id/5010https://security.netapp.com/advisory/ntap-20190919-0005/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764http://fish2.com/ipmi/remote-pw-cracking.htmlhttp://marc.info/?l=bugtraq&m=139653661621384&w=2http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttps://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmihttps://nvidia.custhelp.com/app/answers/detail/a_id/5010https://security.netapp.com/advisory/ntap-20190919-0005/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764