{"id":"CVE-2013-4786","title":"The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP …","summary":"The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-255"],"vendor":"intel","product":"intelligent_platform_management_interface","affected":["fujitsu_m10_firmware <= 2290","intelligent_platform_management_interface = 2.0"],"published":"2013-07-08","updated":"2026-10-09","sourceUpdated":"2026-10-09T19:16:40.670","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2013-4786","references":[{"url":"http://fish2.com/ipmi/remote-pw-cracking.html","label":"cve@mitre.org"},{"url":"http://marc.info/?l=bugtraq&m=139653661621384&w=2","label":"cve@mitre.org"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","label":"cve@mitre.org"},{"url":"https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi","label":"cve@mitre.org"},{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5010","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20190919-0005/","label":"cve@mitre.org"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764","label":"cve@mitre.org"},{"url":"http://fish2.com/ipmi/remote-pw-cracking.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://marc.info/?l=bugtraq&m=139653661621384&w=2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://nvidia.custhelp.com/app/answers/detail/a_id/5010","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20190919-0005/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.7857,"epssPercentile":0.9958,"exploits":{"exploitdb":true,"github":1,"githubRepos":["https://github.com/fin3ss3g0d/CosmicRakp"],"metasploit":["auxiliary/scanner/ipmi/ipmi_dumphashes"],"checkedAt":"2026-10-14T14:32:01.443Z"},"exploitAvailable":true,"ingestedAt":"2026-10-09T20:11:26.048Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-09T18:47:13.778807Z"},"slug":"CVE-2013-4786","body":"## Overview\n\nThe IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.\n\n## Affected\n\n- `fujitsu_m10_firmware <= 2290`\n- `intelligent_platform_management_interface = 2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":69,"depthScoreParts":{"impact":41.3,"likelihood":15.7,"exploitation":12,"ransomware":0},"changes":[]}