A staggering number of nearly 25,000 Internet-facing Blade Management Controllers (BMCs) have been found to be disclosing IPMI password hashes before login, leaving their sensitive data vulnerable to unauthorized access. This significant security lapse affects various organizations worldwide, including government agencies, educational institutions, and private companies.
The BMC is a crucial component in data centers, responsible for managing server hardware remotely. It utilizes the Intelligent Platform Management Interface (IPMI) protocol to securely manage servers without requiring administrative privileges on the operating system level. However, it appears that many BMCs have not properly configured or updated their IPMI settings, resulting in the exposure of password hashes.
The issue arises from a fundamental security misconfiguration: when an administrator resets the BMC’s IPMI password using the web interface, the new hash is stored in plain text within the device’s firmware. If this firmware has not been properly secured and is accessible via the internet, an attacker can exploit the vulnerability to obtain the plaintext password. This allows for unauthorized access to the server, potentially leading to data breaches or even full system compromise.
The exposure of IPMI passwords is a serious concern because it enables attackers to bypass standard login procedures, such as two-factor authentication (2FA) and multi-factor authentication (MFA). Once inside the BMC, an attacker can execute arbitrary commands, modify firmware settings, and potentially gain access to sensitive data stored on connected servers. Furthermore, this vulnerability may serve as a stepping stone for more severe attacks.
The scale of the issue is substantial: researchers have identified nearly 25,000 BMCs exposed online, making it essential for organizations to take immediate action to mitigate this risk. To address this problem, administrators must ensure that their IPMI settings are properly configured and updated. This includes implementing secure password storage practices, such as hashing passwords before storing them in firmware, and securing access to the BMC through network segmentation or other security measures.
In light of this alarming revelation, it is crucial for organizations to reassess their cybersecurity posture, particularly regarding sensitive hardware management interfaces like IPMI. A practical takeaway from this incident is that administrators must prioritize regular security audits and updates to prevent such vulnerabilities from arising in the first place.
Source: The Hacker News — 2026-07-28