CVE-2013-4786

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.

CVSS v3.0

7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

7.8 HIGHAV:N/AC:L/Au:N/C:C/I:N/A:N

EPSS

78.57% chance of exploitation in the next 30 days, 100th percentile

Nuclei

high · CWE-255

Published

2013-07-08

Updated

2024-08-06

Proof-of-concept exploits (1)

• fin3ss3g0d/CosmicRakp42★ · 2025-11-18

Nuclei templates (1)

• geeknik/the-nuclei-templates/blob/main/CVE-2013-4786.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/38633

References

• CVE Record
• NVD entry

Related

• CVE-2024-4956
• CVE-2024-5764
• CVE-2013-4782
• CVE-2013-4787
• CVE-2013-4777
• CVE-2013-4788