IPMI / BMC Exposure Check
A server's Baseboard Management Controller (BMC) — Dell iDRAC, HP iLO, IBM/Lenovo IMM, Supermicro IPMI — gives full out-of-band control of the host: power, serial console and virtual media, independent of the OS. It must never face the public internet. Enter a host or IP and this check probes the IPMI/RMCP management plane on UDP/623 to confirm whether a BMC is reachable, and (in deep mode) whether it accepts the password-less cipher-suite-0 backdoor, anonymous logins, or exposes the RAKP authentication-hash disclosure. It's read-only — it negotiates but never completes a session.
Reviewed by the SysGlass team · Updated July 21, 2026
What it checks
- Whether an IPMI/BMC management plane answers on UDP/623 at all (a silent BMC is the safe result)
- The detected BMC product/vendor (iDRAC, iLO, IMM, Supermicro IPMI, ...) where disclosed
- Cipher suite 0 — the password-less 'cipher zero' backdoor where an unauthenticated client can open a no-auth/no-encryption session and run arbitrary IPMI commands, including resetting the admin password and powering the host (SVC_IPMI_CIPHER0, probed in deep mode)
- Anonymous / null login — password-less sessions via anonymous login or auth-type 'none' (SVC_IPMI_ANON_LOGIN, SVC_IPMI_AUTH_NONE)
- RAKP hash disclosure — IPMI v2.0 RAKP exposing a BMC user's password hash for offline cracking (CVE-2013-4786) (SVC_IPMI_RAKP_EXPOSED)
- The equivalent command — nmap -sU -p623 --script ipmi-version,ipmi-cipher-zero <host>
How to read the result
- OK — no BMC: nothing answered on UDP/623, so the out-of-band management plane isn't reachable from this vantage point. That's the safe result.
- Reachable BMC is already a critical exposure: a publicly exposed BMC gives full power, serial-console and virtual-media control of the server and has a long history of pre-auth vulnerabilities.
- Fail — cipher suite 0: an unauthenticated client can open a no-auth/no-encryption session and run arbitrary IPMI commands — including resetting the admin password and powering the host. This is effectively a full compromise of the server.
- Fail — anonymous / 'none' login: password-less sessions are allowed, so anyone who can reach the port can log into the BMC.
- Warn/Fail — RAKP exposed (CVE-2013-4786): IPMI v2.0 lets a remote attacker retrieve and crack a BMC user's password hash offline.
- Fix in all cases: move the BMC onto an isolated management VLAN reachable only over VPN, and block UDP/623 at the perimeter.
Frequently asked questions
What is a BMC / IPMI and why must it never be on the internet?
A Baseboard Management Controller is a small always-on computer inside a server, reachable over IPMI on UDP/623, that controls power, the serial console and virtual media independently of the operating system. Whoever reaches it effectively owns the hardware. BMCs have a long history of pre-auth flaws, so an internet-facing one is a critical exposure — it belongs on an isolated management network only.
What is IPMI cipher suite 0 (cipher zero)?
Cipher suite 0 is an IPMI v2.0 option that allows a session with no authentication and no encryption. Where it's enabled, an unauthenticated attacker who knows a valid username (often 'admin' or 'ADMIN') can open a session and run arbitrary IPMI commands — resetting passwords, powering the box, mounting virtual media. It should be disabled; this check negotiates it in deep mode without completing a session.
What is the RAKP hash-disclosure flaw (CVE-2013-4786)?
It's a design weakness in IPMI v2.0's RAKP authentication: during the handshake the BMC returns a salted HMAC of the user's password before authentication completes, so a remote attacker can collect it and crack it offline. It can't be fully patched in the protocol — the mitigation is to keep IPMI off untrusted networks and use long, random BMC passwords.
Does the check log into my BMC or change anything?
No. It is read-only. It probes the RMCP/IPMI plane to detect the BMC and, in deep mode, negotiates cipher suite 0 — but it never completes a session, never authenticates, and never sends an IPMI command that changes state. It only determines whether those weaknesses are present.
How do I secure an exposed BMC?
Put every BMC on a dedicated, isolated management VLAN that's only reachable over VPN, and block UDP/623 (and the BMC's web ports) at the perimeter firewall. Disable cipher suite 0 and anonymous/null logins, set strong unique passwords, and keep BMC firmware updated. After that, this check should report nothing reachable on UDP/623 from the outside.
What's the difference between default and deep mode?
Default mode detects whether a BMC is reachable and identifies it. Deep mode additionally negotiates IPMI v2.0 cipher suite 0 to detect the password-less cipher-zero backdoor. Deep mode does more probing but is still read-only and never opens an actual session.