24,000+ Server Management Controllers Exposed via 20-Year-Old Flaw
A decades-old IPMI authentication weakness lets attackers harvest password hashes from internet-facing BMCs, with researchers cracking credentials on at least one-third of exposed systems.
More than 24,000 internet-exposed server management controllers are leaking password hashes through a vulnerability that has existed for approximately two decades, giving attackers direct access to physical server hardware.
Researchers scanning UDP port 623 identified 24,650 vulnerable Baseboard Management Controllers (BMCs) out of 36,872 hosts tested. Dictionary attacks against the exposed hashes recovered actual passwords for at least one-third of the systems.
A Flaw Baked Into the Protocol
The exposure stems from CVE-2013-4786, a weakness in the IPMI 2.0 RAKP (Remote Authentication and Key-Exchange Protocol) authentication mechanism. While publicly disclosed in 2013, the underlying protocol specification dates to 2004.
IPMI 2.0 RAKP allows unauthenticated remote attackers to retrieve the HMAC-SHA1 hash of the BMC administrator password. This enables offline brute-force attacks, where recovered hashes can be cracked without further interaction with the target.
Why BMC Compromise Matters
BMCs are specialized processors embedded in server motherboards that provide out-of-band management capabilities. Administrators use them to power servers on or off, access system consoles, and monitor hardware health, regardless of whether the main operating system is running.
Hardware-level access creates a critical attack surface. An attacker with BMC administrative control can bypass OS-level security entirely, install persistent firmware-level malware, or extract data directly from system memory.
Default Credentials Compound the Risk
The successful password recovery rate reflects a broader industry problem: many BMCs ship with factory default credentials that administrators never change. Combined with RAKP hash exposure, these defaults become trivial to exploit.
The vulnerability has been known for over a decade, with exploitation modules available in penetration testing frameworks like Metasploit. Despite this, thousands of BMCs remain exposed to the public internet, often discoverable through simple port scans.
Remediation Requires Network Segmentation
Security researchers have long recommended that IPMI interfaces never be exposed directly to the internet. BMCs should reside on isolated management networks, accessible only through VPNs or jump hosts with strict access controls.
For organizations with internet-facing BMCs, immediate actions include changing default passwords, updating firmware where vendors have released patches, and implementing network-level restrictions to limit which IP addresses can reach the management interface.
This 20-year-old exposure highlights a broader challenge in enterprise infrastructure: hardware management interfaces often outlive the security practices that should protect them.