Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

IBM IMM allows password hash leak enabling brute‑force login

CVE-2013-4037 · published 13 years ago
Summary

The IBM Integrated Management Module (IMM) and IMM2 used in BladeCenter, Flex System, System x iDataPlex and System x3 servers expose a password hash during remote management. This makes it easier for an attacker on the network to guess the administrator password and gain control of the server. Apply the latest firmware updates from IBM and limit network access to the management interface to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ibm bladecenter hs22
hs22v
hs23
hs23e
hx5
cpe:2.3:h:ibm:bladecenter:hs22:*:*:*:*:*:*:*
ibm flex_system_x220_compute_node All versions
cpe:2.3:h:ibm:flex_system_x220_compute_node:-:*:*:*:*:*:*:*
ibm flex_system_x240_compute_node All versions
cpe:2.3:h:ibm:flex_system_x240_compute_node:-:*:*:*:*:*:*:*
ibm flex_system_x440_compute_node All versions
cpe:2.3:h:ibm:flex_system_x440_compute_node:-:*:*:*:*:*:*:*
ibm system_x_idataplex_dx360_m2_server All versions
cpe:2.3:h:ibm:system_x_idataplex_dx360_m2_server:-:*:*:*:*:*:*:*
ibm system_x_idataplex_dx360_m3_server All versions
cpe:2.3:h:ibm:system_x_idataplex_dx360_m3_server:-:*:*:*:*:*:*:*
ibm system_x_idataplex_dx360_m4_server All versions
cpe:2.3:h:ibm:system_x_idataplex_dx360_m4_server:-:*:*:*:*:*:*:*
ibm system_x3100_m4 All versions
cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:*
ibm system_x3200_m3 All versions
cpe:2.3:h:ibm:system_x3200_m3:-:*:*:*:*:*:*:*
ibm system_x3250_m3 All versions
cpe:2.3:h:ibm:system_x3250_m3:-:*:*:*:*:*:*:*
ibm system_x3250_m4 All versions
cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:*
ibm system_x3400_m2 All versions
cpe:2.3:h:ibm:system_x3400_m2:-:*:*:*:*:*:*:*
ibm system_x3400_m3 All versions
cpe:2.3:h:ibm:system_x3400_m3:-:*:*:*:*:*:*:*
ibm system_x3500_m2 All versions
cpe:2.3:h:ibm:system_x3500_m2:-:*:*:*:*:*:*:*
ibm system_x3500_m3 All versions
cpe:2.3:h:ibm:system_x3500_m3:-:*:*:*:*:*:*:*
ibm system_x3500_m4 All versions
cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:*
ibm system_x3530_m4 All versions
cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:*
ibm system_x3550_m2 All versions
cpe:2.3:h:ibm:system_x3550_m2:-:*:*:*:*:*:*:*
ibm system_x3550_m3 All versions
cpe:2.3:h:ibm:system_x3550_m3:-:*:*:*:*:*:*:*
ibm system_x3550_m4 All versions
cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:*
ibm system_x3620_m3 All versions
cpe:2.3:h:ibm:system_x3620_m3:-:*:*:*:*:*:*:*
ibm system_x3630_m3 All versions
cpe:2.3:h:ibm:system_x3630_m3:-:*:*:*:*:*:*:*
ibm system_x3630_m4 All versions
cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:*
ibm system_x3650_m2 All versions
cpe:2.3:h:ibm:system_x3650_m2:-:*:*:*:*:*:*:*
ibm system_x3650_m3 All versions
cpe:2.3:h:ibm:system_x3650_m3:-:*:*:*:*:*:*:*
ibm system_x3650_m4 All versions
cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:*
ibm system_x3690_x5 All versions
cpe:2.3:h:ibm:system_x3690_x5:-:*:*:*:*:*:*:*
ibm system_x3750_m4 All versions
cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:*
ibm system_x3850_x5 All versions
cpe:2.3:h:ibm:system_x3850_x5:-:*:*:*:*:*:*:*
ibm system_x3950_x5 All versions
cpe:2.3:h:ibm:system_x3950_x5:-:*:*:*:*:*:*:*
Original advisory text
The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter,...
The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash to the client, which makes it easier for remote attackers to obtain access via a brute-force attack.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published9 Aug 2013
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-4037 · NVD
Track software like this
Free during beta