Over 24,000 exposed server BMCs leak password hash via decades-old flaw

More than 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller (BMC) interface.

For at least a third of them, researchers were able to find the correct password using dictionaries and the patterns on factory stickers for default credentials.

The exposed servers are vulnerable to CVE-2013-4786, an IPMI 2.0 authentication weakness rooted in a protocol introduced in 2004.

The security issue allows attackers to request an authentication response that can be used to crack the password offline using dedicated GPU rigs or similar setups.

BMCs and server risks

BMCs are processors built into a server motherboard that allow administrators to remotely manage the system independent of the operating system. They support low-level actions such as powering servers on/off, updating firmware, or mounting virtual media.

Access to BMCs can give attackers control over physical servers, letting them change low-level configurations, apply malicious firmware updates, and compromise the system at a layer not monitored by security solutions.

Researchers at cybersecurity and infrastructure startup Lava say that in real-world settings, recovered credentials may work across multiple management interfaces within the same environment, and that a single compromised BMC could serve as a pivot point to the broader management plane.

In AI environments with poorly segmented infrastructure, attackers could affect multiple tenants simultaneously.

“A physical GPU server can support multiple tenants or workloads through virtualization, GPU partitioning, or other sharing mechanisms,” Lava researchers say.

“In those environments, compromise of one physical server could disrupt or expose several customer workloads.”

Massive exposure

Looking for publicly accessible IPMI services on UDP port 623, the researchers found 36,872 internet-exposed hosts. Of those, 24,650 exposed password-derived authentication material that could be used to perform offline password-cracking attacks.

According to researchers at Lava, 6,240 of the hosts accepted an empty username during authentication, and subsequent testing confirmed that they were also protected by weak passwords.

A number of 2,340 instances used weak administrator passwords that matched public dictionaries, making them very easy to breach.

On a live exposure map seen by BleepingComputer, the United States is at the top of the list with 39% of the vulnerable servers.

Lava researchers note that a large number of the BMCs it found exposed online are Supermicro systems protected by a 10-character uppercase password printed on the chassis label, with the username ‘ADMIN’ in all instances.

They argue that while this format theoretically provides ample headroom, its constrained structure still makes offline cracking practical.

For comparison, the researchers estimated that recovering an HPE factory password would take about 1 day per captured response (an authentication response obtained during the IPMI handshake) on an Apple M3 system.

Activity and response

Lava reports that during its research, it found an internet-exposed HPE iLO 4 login page displaying a ransom note demanding 0.3 BTC.

While this is not proof of widespread exploitation activity, or even successful attempts, it shows that at least some malicious activity is underway.

The researchers notified Supermicro in June, and while the company acknowledged the risk, it noted that official guidance for administrators recommends rotating default BMC passwords and isolating management networks.

The company, though, said it would review stronger default password policies for future hardware revisions.

Lava also notified HPE but received only a standard auto-response message and no follow-up from the vendor’s security team.

The researchers recommend keeping IPMI and Redfish off the public internet, rotating factory BMC passwords, restricting access to isolated management networks, and turning off legacy IPMI authentication.