24,000 Server BMCs Leak Password Hashes via a 20-Year-Old IPMI Flaw

Researchers at Lava, a startup focused on cybersecurity and infrastructure, have found that over 24,000 servers exposed on the internet are leaking authentication password hashes through the baseboard management controller (BMC). The culprit is CVE-2013-4786 — an authentication weakness in the IPMI 2.0 protocol, which dates all the way back to 2004. The flaw lets an attacker request an authentication response from the server, which can then be cracked offline on GPU farms.

Why access to a BMC is dangerous

A BMC is a separate processor on the motherboard that lets administrators manage a server independently of the operating system: powering it on and off, updating firmware, mounting virtual media. Once an attacker gains control of a BMC, they operate at a level that ordinary security tools don't monitor — able to change low-level settings and flash malicious firmware.

The danger is compounded by the fact that recovered credentials often work on other management interfaces in the same environment as well, turning a single compromised BMC into a foothold across the entire control plane. In poorly segmented AI infrastructure, where a physical GPU server serves multiple tenants through virtualization and GPU partitioning, compromising one machine can affect several customers at once.

The scale of the problem

Scanning UDP port 623, the researchers found 36,872 reachable hosts, 24,650 of which were leaking material for offline password cracking. On 6,240 systems, authentication succeeded even with an empty username, and 2,340 used weak administrator passwords that matched public wordlists. According to a map of the vulnerable servers, the United States leads with 39% of all findings.

A significant share of the devices are Supermicro systems with a 10-character uppercase password printed right on the chassis and the unchangeable username ADMIN. On paper such a password is strong enough, but its predictable structure makes cracking practical. For comparison, the researchers estimated that recovering a factory HPE password takes roughly one day on a single authentication response using an Apple M3.

The response and recommendations

There are already signs of real-world attacks: on one exposed HPE iLO 4 login page, the researchers saw a ransom demand of 0.3 BTC. Supermicro acknowledged the risk, advised changing factory passwords and isolating management networks, and promised to consider a stricter password policy in future hardware revisions. HPE responded only with an automated message.

Experts advise against exposing IPMI and Redfish to the internet, and recommend changing factory BMC passwords, restricting access to isolated management networks, and disabling legacy IPMI authentication.

Source: Bleeping Computer