Decades-Old BMC Flaw Exposes Servers

A long-standing security vulnerability has left tens of thousands of internet-exposed server management interfaces vulnerable to credential harvesting. The issue centers on the Baseboard Management Controller (BMC), a specialized service processor that provides administrators with out-of-band management capabilities, independent of the host operating system.

The Risks of Exposed Management Planes

BMCs allow for critical low-level tasks, including power management, firmware updates, and the attachment of virtual media. Because these controllers operate beneath the primary OS, they often exist outside the visibility of conventional host-based security tools. If an attacker gains unauthorized access, they can exert control over the physical server, potentially deploying malicious firmware or reconfiguring low-level settings without triggering standard system alerts.

Researchers at Lava identified that CVE-2013-4786, an authentication weakness within the IPMI 2.0 protocol dating back to 2004, remains a significant vector for compromise. By targeting UDP port 623, unauthorized actors can request authentication responses from these interfaces, which are then susceptible to offline brute-force attacks using GPU-accelerated rigs.

Quantifying the Current Exposure

• 24,650 servers are currently leaking authentication password hashes.
• 36,872 total hosts were identified with publicly accessible IPMI services.
• 6,240 hosts were found to accept an empty username during the authentication process.
• 2,340 instances were protected by weak administrative passwords found in public dictionaries.
• 39% of the vulnerable servers are located within the United States.

Infrastructure Pivot Points and Risks

The impact of this exposure extends beyond individual server compromise, particularly in modern computing environments. Because management credentials are often reused across internal networks, a single breached BMC can provide a pivot point to other areas of the management plane. This risk is amplified in virtualized environments where hardware resources are shared across multiple tenants.

A physical GPU server can support multiple tenants or workloads through virtualization, GPU partitioning, or other sharing mechanisms. In those environments, compromise of one physical server could disrupt or expose several customer workloads.

— Lava researchers

Implications for Security Strategy

The discovery underscores the persistent threat posed by legacy protocols that remain active in modern data centers. While some hardware manufacturers like Supermicro have acknowledged the issue and suggested rotating default passwords, the lack of consistent industry-wide remediation—exemplified by limited engagement from some vendors—highlights the burden placed on infrastructure owners. For organizations, the primary defense involves isolating management networks from the public internet, disabling outdated authentication methods, and rigorously rotating any factory-default credentials found on chassis labels. Failure to address these low-level entry points may allow adversaries to maintain a foothold that remains invisible to standard monitoring layers.