Decades-Old BMC Flaw Exposes Over 24,000 Servers to Password Hash Theft
A 20-year-old vulnerability in server Baseboard Management Controllers (BMCs) is exposing authentication password hashes for over 24,000 internet-connected servers, enabling offline cracking of sensitive credentials.
Over 24,000 internet-exposed servers are leaking authentication password hashes due to a two-decade-old vulnerability in their Baseboard Management Controller (BMC) interfaces. This flaw, rooted in the IPMI 2.0 protocol which was introduced in 2004, allows attackers to retrieve password hashes that can then be cracked offline using specialized hardware, potentially leading to the compromise of sensitive server management credentials.
BMCs are critical components embedded in server motherboards, providing out-of-band management capabilities. They enable administrators to perform low-level actions such as powering systems on or off, updating firmware, and mounting virtual media, all independently of the main operating system. This remote access capability, while essential for efficient server administration, also presents a significant risk if compromised.
Access to a compromised BMC can grant attackers complete control over physical servers. This includes the ability to alter low-level configurations, deploy malicious firmware, and compromise the system at a fundamental layer that is often invisible to standard security solutions. Researchers from cybersecurity startup Lava highlighted that in real-world scenarios, recovered credentials from one BMC could potentially be used to access other management interfaces within the same network, turning a single compromised server into a pivot point for broader network infiltration.
In environments utilizing virtualization, such as AI training clusters with poorly segmented infrastructure, a single compromised physical server could impact multiple tenants or workloads simultaneously. This is particularly concerning for GPU servers that often support multi-tenant operations through various sharing mechanisms. The compromise of one such server could lead to widespread disruption or data exposure for several customers.
Researchers identified the vulnerability by scanning for publicly accessible IPMI services on UDP port 623, discovering 36,872 internet-exposed hosts. Of these, a substantial 24,650 hosts were found to be exposing authentication material suitable for offline password-cracking attacks. Further analysis revealed that 6,240 of these hosts accepted an empty username during authentication, and many others used weak, dictionary-common passwords, making them particularly easy targets.
The United States accounts for the largest share of these vulnerable servers, with 39% of the exposed systems located within its borders. Lava researchers noted that a significant number of the affected BMCs belong to Supermicro systems. These often feature a 10-character uppercase password printed on a chassis label, paired with the username 'ADMIN'. While the length of these passwords might seem robust, their constrained format still makes them susceptible to practical offline cracking.
Evidence of malicious activity related to exposed BMCs has surfaced, with researchers observing an internet-exposed HPE iLO 4 login page displaying a ransom note demanding 0.3 BTC. While this single instance does not confirm widespread exploitation, it indicates that attackers are actively probing and potentially targeting these exposed systems.
In response to the findings, Lava notified Supermicro in June, which acknowledged the risk and reiterated its guidance for administrators to rotate default passwords and isolate management networks, while also stating it would review stronger default password policies for future hardware. HPE, however, provided only a standard auto-response to Lava's notification. Security best practices include keeping IPMI and Redfish interfaces off the public internet, regularly changing default BMC passwords, restricting access to isolated management networks, and disabling legacy IPMI authentication protocols.
This new research reveals that the vulnerability, CVE-2013-4786, affects approximately 36,872 Baseboard Management Controllers (BMCs) accessible from the public internet. Of these, a significant 24,650 instances were found to leak password hashes before authentication, with roughly two-thirds of those hashes deemed recoverable through common wordlists or predictable factory formats. The research also highlights that Supermicro hardware constitutes a majority of the affected BMCs, and that factory-issued passwords, while unique, follow a predictable format that can be cracked within hours using modern hardware.