PT-2013-5193 · Hewlett Packard · Hp Integrated Lights-Out+2

Dan Farmer · Published 2013-07-08 · Updated 2026-03-10 · CVE-2013-4786

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out versions 2 through 5 HPE Superdome Flex RMC (affected versions not specified)

Description The issue allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC. This could enable an attacker to gain unauthorized privileges and unauthorized access to privileged information.

Recommendations For HPE Integrated Lights-Out versions 2 through 5, update to a version that addresses the RAKP authentication issue to prevent unauthorized access. For HPE Superdome Flex RMC, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-4786

Affected Products

Hp Integrated Lights-Out

Hpe Superdome Flex Rmc

Hpe Ilo

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb · Exploit
• 🔥 https://github.com/fin3ss3g0d/CosmicRakp · Exploit
• 🔥 https://exploit-db.com/exploits/38633 · Exploit
• http://marc.info/?l=bugtraq&m=139653661621384&w=2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4786 · Security Note
• https://github.com/kleiton0x00/Proxy-DLL-Loads · Note
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04197764 · Note
• http://oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html · Note
• https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi · Note
• https://t.me/cybersecuritytechnologies/9255 · Telegram Post
• https://nvidia.custhelp.com/app/answers/detail/a_id/5010 · Note
• https://security.netapp.com/advisory/ntap-20190919-0005 · Note
• http://fish2.com/ipmi/remote-pw-cracking.html · Note