Exposed BMCs Leak Password Hashes Due to IPMI Vulnerability

Over 24,000 internet-exposed Baseboard Management Controllers (BMCs) are leaking authentication password hashes due to a vulnerability (CVE-2013-4786) in the IPMI 2.0 protocol, introduced in 2004. Researchers from Lava identified 36,872 servers with exposed management interfaces, with 24,650 disclosing password-derived hashes before login. Many of these hashes can be cracked using common wordlists and predictable factory passwords. The exposure is particularly concerning for Supermicro and HPE servers, which often use weak default credentials. The compromised BMCs allow attackers to gain control over physical servers, potentially affecting multiple tenants in shared environments. The risk is exacerbated by poor network segmentation and access controls in the management networks. This vulnerability poses a significant threat to data center infrastructure, as a single compromised BMC can serve as a foothold for broader attacks.

Key Points: • Over 24,000 BMCs are leaking password hashes due to CVE-2013-4786. • Many exposed servers use weak default credentials, making them easy targets. • Compromised BMCs can allow attackers to control physical servers and disrupt multiple tenants.