Cybersecurity experts have discovered that thousands of Internet-exposed server management controllers are vulnerable to a highly privileged takeover. These systems, known as Baseboard Management Controllers (BMCs), can be exploited by attackers using offline password-cracking techniques, allowing them to gain access to underlying servers and potentially wreak havoc on data center operations.
The issue affects some 24,000 BMC endpoints that are exposed online via UDP port 623, which is used for remote hardware management. Researchers at Lava discovered the flaw when investigating Internet-exposed BMCs for vulnerabilities and found evidence of attackers having exploited it in the wild. The vulnerability, which has been present since 2004, allows an attacker to obtain password-derived authentication hashes from a BMC without authenticating themselves.
A BMC is a small processor built into a server’s motherboard that operates independently of the main processor and operating system. It provides administrators with remote access to hardware functions such as rebooting or powering servers on and off, as well as monitoring system health. BMCs are typically accessed through older protocols like Intelligent Platform Management Interface (IPMI) or newer APIs like Redfish.
The issue stems from a flaw in the IPMI 2.0 authentication protocol that causes a BMC to return password-derived authentication hashes to an unauthenticated client before the login process is complete. This allows an attacker to obtain the hash and use it to try and brute-force the password offline, making it especially useful for cracking weak or reused passwords.
Lava’s research revealed that thousands of potentially vulnerable systems exist, with 6,240 BMCs accepting empty usernames paired with weak passwords, and 2,340 having named accounts with easily guessable passwords. In some cases, Lava was able to crack passwords in minutes using offline brute-force attacks. The researchers also found that default passwords not present in common wordlists could potentially be cracked due to their predictable formats.
The discovery of this vulnerability highlights the importance of securing BMCs and ensuring that password policies are robust. “A compromised BMC puts defenders in a uniquely difficult position,” said Michael Katchinskiy, a researcher at Lava. “Most security tools monitor the operating system, kernel, containers, and workloads, but the BMC operates outside that trust boundary, giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.”
To mitigate this risk, administrators should ensure that all BMCs are properly configured with strong passwords and that IPMI is disabled if not needed. Regularly scanning for exposed BMCs and updating password policies can also help prevent potential attacks. Additionally, it’s essential to consider the security implications of using older protocols like IPMI 2.0 and migrate to newer APIs like Redfish when possible.
As the cybersecurity landscape continues to evolve, it’s crucial that administrators prioritize the security of their data center operations and take proactive measures to prevent attacks like this one. By doing so, they can minimize the risk of a highly privileged takeover and protect their organizations from potential harm.
Source: Dark Reading — 2026-07-28