CVE-2013-4037

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-08-09 · updated 2026-06-16

Description

The RAKP protocol support in the Intelligent Platform Management Interface (IPMI) implementation in Integrated Management Module (IMM) and Integrated Management Module II (IMM2) on IBM BladeCenter, Flex System, System x iDataPlex, and System x3### servers sends a password hash to the client, which makes it easier for remote attackers to obtain access via a brute-force attack.

Affected products

IBM Bladecenter: hs22, hs22v, hs23, hs23e, hx5
IBM Flex System X220 Compute Node: all versions
IBM Flex System X240 Compute Node: all versions
IBM Flex System X440 Compute Node: all versions
IBM System X3100 M4: all versions
IBM System X3200 M3: all versions
IBM System X3250 M3: all versions
IBM System X3250 M4: all versions
IBM System X3400 M2: all versions
IBM System X3400 M3: all versions
IBM System X3500 M2: all versions
IBM System X3500 M3: all versions
IBM System X3500 M4: all versions
IBM System X3530 M4: all versions
IBM System X3550 M2: all versions
IBM System X3550 M3: all versions
IBM System X3550 M4: all versions
IBM System X3620 M3: all versions
IBM System X3630 M3: all versions
IBM System X3630 M4: all versions
IBM System X3650 M2: all versions
IBM System X3650 M3: all versions
IBM System X3650 M4: all versions
IBM System X3690 X5: all versions
IBM System X3750 M4: all versions
IBM System X3850 X5: all versions
IBM System X3950 X5: all versions
IBM System X Idataplex Dx360 M2 Server: all versions
IBM System X Idataplex Dx360 M3 Server: all versions
IBM System X Idataplex Dx360 M4 Server: all versions

References

Get alerted when CVE-2013-4037 or the next vulnerability affects your stack