Thousands of Data Center Controllers Left Vulnerable to Takeover Attacks
A staggering 24,000 Internet-exposed server management controllers are sitting ducks for offline password-cracking attacks, leaving their underlying servers wide open to takeover. This is because these management controllers, known as Baseboard Management Controllers (BMCs), contain a long-standing flaw in the IPMI 2.0 authentication protocol that allows attackers to obtain password hashes and use them to brute-force weak passwords.
The BMCs operate independently of the server’s operating system, kernel, containers, and workloads, making them nearly invisible to conventional security tools. This means that even if a server has robust security measures in place, its BMC can still be compromised without being detected. In fact, researchers at Lava have found evidence of attackers exploiting this issue in the wild.
The vulnerability, identified as CVE-2013-4786, dates back to 2004 when IPMI 2.0 was released. It allows an attacker who can reach UDP port 623, used by IPMI, without authenticating to obtain the password hash and use it to try and crack weak passwords offline. Unlike online login attempts, this process doesn’t require a new request to the BMC for every password candidate, making it easier for attackers to crack predictable or reused passwords.
Lava’s scan of 24,650 BMC endpoints found that thousands are vulnerable to this issue. Of these, over 6,000 accepted empty usernames paired with weak passwords, while over 2,300 had named accounts like ADMIN or root whose passwords matched common wordlists. In many cases, Lava was able to find passwords in just minutes.
The BMC’s privileged position in the data center makes it a critical control point that should not be overlooked. As Lava’s chief technology officer and co-founder Yakir Kadkoda notes, “It operates independently of the operating system and can provide remote console access, power control, virtual media, firmware management, and low-level configuration.” Compromising a BMC would give an attacker unparalleled access to the underlying server.
The fact that this vulnerability has been around for over two decades is concerning. It’s clear that many organizations have not taken adequate steps to address it, leaving their data centers vulnerable to takeover attacks. The time has come for system administrators and security teams to take action and ensure that their BMCs are properly secured.
So what can you do to protect your organization? First, identify any Internet-exposed BMCs in your data center and take immediate action to secure them. This may involve changing default passwords, implementing two-factor authentication, or restricting access to the BMC. Second, review your security tools and ensure that they are monitoring for any signs of BMC compromise. Finally, educate yourself and your team on the risks associated with BMC vulnerabilities and take steps to address them before it’s too late.
By taking these proactive measures, you can help prevent a potentially catastrophic takeover attack on your data center. Don’t wait – start securing your BMCs today.
Source: Dark Reading — 2026-07-28