Loading vulnerability…
CVE-2013-4786 is an authentication weakness in the IPMI 2.0 RMCP+ Authenticated Key-Exchange Protocol (RAKP) used by Baseboard Management Controllers. A remote attacker that can reach the IPMI service can initiate the RAKP handshake and obtain password-derived authentication material from the RAKP message 2 response before successfully authenticating. Specifically, the BMC returns an HMAC value derived from the target account password together with session values known to the requester, allowing the attacker to perform offline password guessing against the captured response. The issue is rooted in the protocol design rather than a single vendor implementation, and affects internet-exposed BMC interfaces that support the vulnerable IPMI 2.0 authentication flow.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains 'CosmicRakp', a Go-based exploit tool targeting CVE-2013-4786 in IPMI 2.0 devices. The exploit leverages a flaw in the RAKP authentication protocol, allowing an unauthenticated attacker to retrieve salted password hashes from vulnerable IPMI devices over UDP port 623. The main logic is implemented in 'main.go', which orchestrates scanning either a range of IPs or a list of targets, using a list of common usernames (from 'users.txt'). The 'ipmi/ipmi.go' file handles the low-level IPMI protocol interactions, including session establishment and hash extraction. The tool supports multi-threaded operation and can resume interrupted scans. Extracted hashes are saved to 'output.txt' for offline cracking. The repository is structured with clear separation between protocol logic, utility functions, and the main orchestration code. This is a proof-of-concept exploit, not a detection script, and is intended for use by red teamers and penetration testers.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity information disclosure weakness inherent to the IPMI v2.0 specification that allows unauthenticated remote attackers to obtain password-derived authentication hashes from exposed BMCs and perform offline password cracking.
An IPMI 2.0 authentication weakness in BMC interfaces that allows attackers to obtain authentication responses and crack passwords offline, potentially leading to compromise of server management interfaces and broader infrastructure.
An authentication weakness in the IPMI 2.0/RAKP handshake that allows an unauthenticated attacker reaching UDP port 623 on a BMC to obtain password-derived authentication material for offline cracking, potentially leading to compromise of out-of-band server management.
An authentication weakness in internet-exposed BMC interfaces that discloses password-derived authentication hashes before login, enabling recovery of credentials and potentially highly privileged access below the operating system.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.