Loading vulnerability…
CVE-2013-4786 is an information disclosure vulnerability in the IPMI 2.0 RMCP+ Authenticated Key-Exchange Protocol (RAKP) used by Baseboard Management Controllers. During the RAKP authentication exchange, a vulnerable BMC returns a password-derived HMAC, commonly described as the RAKP message 2 response, to a remote unauthenticated requester before authentication is completed. Because the response is derived from the target account password and session values known to the requester, an attacker can capture this material and perform offline password guessing against valid BMC accounts. The weakness is inherent to the IPMI 2.0 authentication design rather than a simple implementation bug, and it has been widely observed on Internet-exposed BMC interfaces.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains 'CosmicRakp', a Go-based exploit tool targeting CVE-2013-4786 in IPMI 2.0 devices. The exploit leverages a flaw in the RAKP authentication protocol, allowing an unauthenticated attacker to retrieve salted password hashes from vulnerable IPMI devices over UDP port 623. The main logic is implemented in 'main.go', which orchestrates scanning either a range of IPs or a list of targets, using a list of common usernames (from 'users.txt'). The 'ipmi/ipmi.go' file handles the low-level IPMI protocol interactions, including session establishment and hash extraction. The tool supports multi-threaded operation and can resume interrupted scans. Extracted hashes are saved to 'output.txt' for offline cracking. The repository is structured with clear separation between protocol logic, utility functions, and the main orchestration code. This is a proof-of-concept exploit, not a detection script, and is intended for use by red teamers and penetration testers.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An IPMI 2.0 authentication protocol vulnerability that allows offline cracking of administrator-level BMC account passwords, leaving large numbers of Internet-exposed baseboard management controllers vulnerable.
A flaw in the IPMI 2.0 authentication protocol that lets an unauthenticated remote attacker obtain password-derived authentication hashes from a BMC and crack them offline, exposing highly privileged server-management interfaces.
An authentication weakness in the IPMI 2.0 Remote Authenticated Key-Exchange Protocol that lets unauthenticated attackers retrieve password-derived HMAC-SHA1 data and crack credentials offline, potentially leading to compromise of exposed Baseboard Management Controllers.
An IPMI 2.0 authentication weakness that causes vulnerable BMC interfaces to return password-derived authentication data, enabling offline password cracking against exposed server management interfaces.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.