Vulnerability · NVD published 2013-07-08
CVE-2013-4786
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
- First PoC
- 4727 days →Metasploit
Signals
- Exploited in the wild
- Not on KEVNot in CISA's catalogue as of the last daily pull. Absence is not proof of safety.
- EPSS · 30-day forecast
- 79%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · HIGH
- 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
2 known · links onlyMetasploit1
This module identifies IPMI 2.0-compatible systems and attempts to retrieve the HMAC-SHA1 password hashes of default usernames. The hashes can be stored in a file using the OUTPUT_FILE option and then cracked using hmac_sha1_crack.rb in the tools subdirectory as well hashcat (cpu) 0.46 or newer using type 7300.
ruby · seen 2026-10-18
Exploit-DB1
created 2013-07-02
On the wire
1 dispatchWatch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.