24,650 Internet-Exposed Server Controllers Leak Password Hashes to Unauthenticated Attackers

A Two-Decade-Old Flaw Exposes Data Centers

Researchers at security firm Lava identified approximately 24,650 internet-exposed Baseboard Management Controllers (BMCs) vulnerable to CVE-2013-4786, a critical authentication bypass in the IPMI 2.0 protocol that allows unauthenticated attackers to extract password-derived hashes via UDP port 623.

Of 36,872 internet-exposed server-management interfaces running IPMI, the vulnerable 24,650 disclosed authentication hashes before any login attempt, enabling offline password cracking. The flaw was introduced in 2004 and publicly disclosed in 2013, yet remains actively exploited more than a decade later.

Why BMCs Matter

BMCs are dedicated processors embedded on server motherboards that handle remote hardware management: powering systems on and off, rebooting, monitoring health metrics, and providing full remote console access. They operate independently of the server's operating system and kernel, possessing privileges that extend beneath the host itself.

"The BMC operates outside that trust boundary, giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it," said Michael Katchinskiy, a Lava researcher.

This architectural position makes BMC compromise particularly dangerous. Standard security monitoring tools cannot detect activity at this level, and a breached controller grants attackers the ability to modify firmware, access storage directly, and deploy ransomware with persistence that survives OS reinstallation.

Weak Credentials Compound the Risk

The exposure is worsened by poor credential hygiene. Of the 24,650 vulnerable BMCs, 6,240 accepted empty usernames paired with weak passwords, while 2,340 had named accounts such as ADMIN or root whose passwords matched common wordlists.

Evidence indicates active exploitation in the wild. Lava's team observed ransomware attacks targeting exposed HPE iLO interfaces and identified compromised systems belonging to one of the world's largest automotive component manufacturers, said Yakir Kadkoda, CTO and cofounder at Lava.

The Path to Data Center Takeover

Because BMCs are typically deployed on out-of-band management networks that are poorly segmented from production infrastructure, a single compromised controller can enable lateral movement across an entire data center. Attackers can pivot to other servers, access provisioning infrastructure, and breach multitenant GPU clouds.

Remediation is not straightforward. Unlike typical server compromises that can be cleaned by reimaging the OS, BMC breaches may require hardware replacement or firmware re-flashing to fully eradicate attacker persistence.

The findings underscore the risk of leaving legacy management protocols exposed to the internet, particularly when those protocols govern infrastructure with privileges that extend beyond conventional security boundaries.