Over 24,000 Servers Expose Password Hashes via BMC Vulnerability

• •Over 24,000 servers are leaking password hashes due to a 20-year-old BMC vulnerability.
• •CVE-2013-4786 allows attackers to exploit weak authentication in IPMI 2.0.
• •Compromised BMCs can enable extensive control over servers, bypassing typical security measures.

A significant vulnerability in Baseboard Management Controllers (BMCs) has been identified, exposing over 24,000 servers to the internet. This exposure is due to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol, allowing attackers to retrieve password hashes before login. Researchers from Lava found that 36,872 BMC interfaces were publicly accessible, with 24,650 leaking authentication hashes that could be cracked offline. Many of these servers, particularly from Supermicro and HPE, are still using weak or default passwords, making them easy targets. The compromised BMCs can provide attackers with extensive control over the servers, enabling them to execute malicious actions beneath the visibility of traditional security measures. The issue is exacerbated in environments with poor segmentation, potentially affecting multiple tenants simultaneously. Immediate action is recommended to secure these vulnerable systems.