Port 623 – IPMI / ASF-RMCP (Intelligent Platform Management Interface)

Port 623 is the default UDP port for IPMI (Intelligent Platform Management Interface), carried over ASF-RMCP — the Alert Standard Format Remote Management and Control Protocol. It’s the out-of-band channel that server BMCs (Baseboard Management Controllers) listen on — Dell iDRAC, HP iLO, Supermicro/ASPEED, Lenovo XCC — so an administrator can power-cycle, reinstall, or get KVM and serial-console access to a machine even when its operating system is dead. A BMC is a tiny always-on computer with full physical control of the host, and IPMI’s own design hands a password hash to anyone who asks. That combination makes an exposed port 623 one of the highest-value findings on any external or internal engagement — a foothold that grants lights-out control below the OS.

Why It’s Open

Almost every rack server ships a BMC, and IPMI is the vendor-neutral standard those controllers speak. Dell brands it iDRAC, HP calls it iLO, Lenovo uses XCC, and a large share of the market runs the same ASPEED chip and firmware underneath Supermicro and whitebox boards. Data centres rely on IPMI-over-LAN so staff never have to touch a physical console — they mount virtual media, watch POST, and reboot hosts remotely on UDP 623. The controller is meant to sit on a locked-down management VLAN, but in practice it often shares a subnet with production or, worse, faces the internet. Where 623 answers, the BMC’s other surfaces are usually one scan away: the web management UI on 443/80, SNMP monitoring on 161, and on hypervisor hosts the VMware management stack on 902.

Common Risks

• RAKP password-hash disclosure. The IPMI 2.0 spec itself is the bug. During the RAKP handshake the BMC returns a salted HMAC of the requested user’s password before authentication completes, so an unauthenticated attacker pulls the hash and cracks it offline (CVE-2013-4786).
• Cipher 0 authentication bypass. Many BMCs accept cipher-suite 0, which means “no authentication at all.” Send any password and you get full IPMI access — read the user list, add accounts, or reset the box.
• Default and weak BMC credentials. Controllers ship with well-known pairs: Supermicro ADMIN/ADMIN, Dell iDRAC root/calvin, older iLO defaults. They survive far longer than OS passwords because nobody logs into the BMC day to day.
• Anonymous and null user accounts. Some BMCs leave an unnamed or null-password account enabled, giving instant access without guessing anything.
• Full lights-out control equals host compromise. IPMI can power the server off, mount an attacker’s ISO as virtual media, and open a KVM/serial console — enough to boot single-user, reset root, or reimage. The BMC also often reaches the production network the host sits on.
• Rarely patched, hard to segment. BMC firmware is updated far less often than the OS, and the management plane is frequently mixed into general subnets, so a single exposed 623 can pivot into the wider estate.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and IPMI version

nmap -sU -p 623 <target>
nmap -sU -p 623 --script ipmi-version <target>

Test for the Cipher 0 authentication bypass

nmap -sU -p 623 --script ipmi-cipher-zero <target>

Dump RAKP password hashes and crack them

msfconsole -q
use auxiliary/scanner/ipmi/ipmi_version
set RHOSTS <target>
run

# CVE-2013-4786 — pull HMAC-SHA1 hashes of BMC users, no auth needed
use auxiliary/scanner/ipmi/ipmi_dumphashes
set RHOSTS <target>
set OUTPUT_JOHN_FILE ipmi_hashes.txt
run

# Cipher 0 bypass check
use auxiliary/scanner/ipmi/ipmi_cipher_zero
set RHOSTS <target>
run

# Crack the retrieved RAKP hashes offline (hashcat IPMI mode)
hashcat -m 7300 ipmi_hashes.txt rockyou.txt

Brute-force IPMI accounts

nmap -sU -p 623 --script ipmi-brute <target>

Talk to the BMC directly with ipmitool

# Normal authenticated query over IPMI 2.0
ipmitool -I lanplus -H <target> -U ADMIN -P ADMIN chassis status

# Abuse Cipher 0 (-C 0): any password is accepted if the BMC is vulnerable
ipmitool -I lanplus -C 0 -H <target> -U ADMIN -P anything user list

Every hash you dump, default credential you confirm, and BMC you can power-cycle is a finding — keep it with the run so it lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

• CVE-2013-4786 — The headline IPMI flaw and a spec-level design bug, not a vendor slip. IPMI 2.0’s RMCP+ RAKP handshake returns an HMAC (SHA1 or MD5) of the requested user’s password in the RAKP message 2 response, before authentication finishes, so any unauthenticated attacker on UDP 623 harvests hashes and cracks them offline. CVSS v2 7.8 (AV:N/AC:L/Au:N/C:C/I:N/A:N), CVSS v3.0 7.5. Weaponised by Metasploit’s ipmi_dumphashes module and Exploit-DB 38633; crack the output with hashcat mode 7300.
• Cipher 0 authentication bypass — design/config flaw, no single CVE. From Dan Farmer and HD Moore’s 2013 IPMI research: many BMCs accept cipher-suite 0 (clear-text, “no cipher”) and then honour any password, so an attacker runs arbitrary IPMI commands unauthenticated. Confirmed across HP, Dell, and Supermicro implementations. Detect with nmap ipmi-cipher-zero or Metasploit ipmi_cipher_zero.
• Default, null, and anonymous accounts — not a CVE, a configuration failure. Supermicro ADMIN/ADMIN, Dell iDRAC root/calvin, legacy iLO defaults, and BMCs that leave an anonymous/null account enabled all grant IPMI access with no real credential. Enumerate with ipmi-brute, then spray the known vendor pairs.
• Scope note — vendor BMC web CVEs. Bugs in the iDRAC, iLO, and Supermicro web/firmware interfaces (for example the ASPEED “Pantsdown” host-interface flaw, CVE-2019-6260, and Intel AMT’s CVE-2017-5689) are frequently lumped in with port 623, but they live on the BMC web UI over 443/80 or the host-side interface — not on IPMI/UDP 623. Test them there; keep the 623 finding scoped to the IPMI protocol itself.

Mitigation

• Never expose port 623 to the internet. No BMC should be reachable from the public network. Block UDP 623 at the perimeter and confirm with an external rescan — this single step neutralises the RAKP and cipher-0 attacks from outside.
• Put every BMC on an isolated management VLAN. Segment the management plane away from production, and allow IPMI only from a small set of admin hosts. A dedicated IPMI NIC that never touches the data network is the goal.
• Change the default credentials. Replace ADMIN/ADMIN, root/calvin, and any vendor defaults with long, unique passwords, and delete anonymous or null accounts.
• Disable Cipher 0. Turn off cipher-suite 0 on every BMC that supports the setting so clear-text “any password” access is impossible.
• Restrict and minimise IPMI users. Keep the account list short, give each user only the privilege level it needs, and disable IPMI-over-LAN entirely on hosts that don’t require remote management.
• Patch BMC firmware. RAKP hash disclosure can’t be fully fixed in firmware, which is exactly why network isolation and strong passwords matter — but keep iDRAC/iLO/Supermicro firmware current to close the vendor web and host-interface bugs.

Real-World Example

In late 2018, the JungleSec ransomware campaign hit Linux servers by walking straight through their IPMI interfaces. As documented by BleepingComputer, victims traced the intrusion to BMCs still using the factory ADMIN/ADMIN credentials (in one case the Admin account had been disabled, yet the attacker still got in). Using IPMI-over-LAN on port 623, the attackers opened the remote console, rebooted each server into single-user mode to get root, then downloaded and compiled the ccrypt utility to encrypt the filesystem and demanded 0.3 BTC. Nothing about it needed a zero-day — it started with a management controller answering on 623 with a password the vendor set and nobody changed, which is the exact exposure a pentest flags on day one.

FAQ

What is port 623 used for?

Port 623 is the UDP port for out-of-band server management. It carries ASF-RMCP and, in practice, IPMI — the protocol a server’s BMC (Baseboard Management Controller) speaks so administrators can monitor hardware, power the machine on and off, and reach a remote console even when the operating system is offline.

Is port 623 TCP or UDP?

IPMI over LAN uses UDP 623 by default, and that’s where enumeration and attacks focus. The ASF-RMCP registration also covers TCP 623, but real-world IPMI traffic is UDP.

What is IPMI and how does it relate to port 623?

IPMI (Intelligent Platform Management Interface) is the standard for out-of-band hardware management. The BMC that implements it — Dell iDRAC, HP iLO, Supermicro/ASPEED, Lenovo XCC — listens for IPMI-over-LAN messages on UDP 623, layered on top of the ASF-RMCP framing. So when you see port 623 open, you’re almost always looking at a BMC exposing IPMI.

Is port 623 dangerous?

If it’s reachable by an attacker, yes. IPMI 2.0’s RAKP handshake leaks a crackable password hash to anyone who asks (CVE-2013-4786), many BMCs accept the cipher-0 bypass, and default credentials are common. A compromised BMC gives power control, virtual media, and console access — effectively full control of the host below the OS. Behind an isolated management VLAN the risk drops sharply; internet-facing, it’s a critical exposure.

How do I secure or close port 623?

Never expose it to the internet, and move every BMC onto a segmented management VLAN reachable only from admin hosts. Change default credentials, disable cipher 0, remove anonymous/null accounts, keep the IPMI user list minimal, and update BMC firmware. Disable IPMI-over-LAN entirely on hosts that don’t need remote management, then rescan UDP 623 to confirm it no longer answers.

TL;DR

• Service: IPMI (Intelligent Platform Management Interface) over ASF-RMCP — out-of-band BMC management (iDRAC, iLO, Supermicro/ASPEED, XCC)
• Default port: 623/UDP (BMC web UI lives on 443/80, monitoring on 161)
• Biggest risk: RAKP hash disclosure (CVE-2013-4786), the cipher-0 auth bypass, and default BMC credentials — all granting lights-out control of the host
• Mitigation: never expose 623, isolate BMCs on a management VLAN, change defaults, disable cipher 0, restrict IPMI users, and patch firmware