Over 24,650 Internet-Exposed Server BMCs Leak Password Hashes via 20-Year-Old IPMI Flaw
Researchers found 24,650 of 36,872 exposed server management interfaces disclose crackable password hashes before login, via a 2013 IPMI flaw still unpatched by Dell.
Editor's Note ·
- Correction:
- The article states, citing BleepingComputer, that 'researchers found those Supermicro factory passwords could be recovered in approximately one hour using modern GPU hardware' and that HPE's factory passwords were 'recoverable within about a minute using modern GPU hardware.' Both figures are accurate, but they were reported by The Hacker News, not BleepingComputer: 'HPE iLO factory passwords were recoverable within a minute using modern GPU hardware, while Supermicro factory passwords were recoverable in approximately one hour.' BleepingComputer's own reporting gives only the separate Apple M3 timing (about a day per captured response for HPE), which the article correctly attributes.
Overview
Of 36,872 internet-exposed server-management interfaces running the Intelligent Platform Management Interface (IPMI) protocol, 24,650 have been found to disclose password-derived authentication hashes before login completes, according to The Hacker News. The exposure stems from CVE-2013-4786, a flaw in the IPMI 2.0 specification that Dell has said cannot be patched because it is inherent to the protocol design, according to The Hacker News.
What We Know
Baseboard Management Controllers (BMCs) are processors built into server motherboards that allow administrators to manage a machine remotely, independent of its operating system, according to BleepingComputer. Cybersecurity researchers scanned the public internet and found 36,872 exposed hosts running IPMI, of which 24,650 leaked authentication material that can be used for offline password cracking, according to BleepingComputer and The Hacker News.
The underlying vulnerability, CVE-2013-4786, carries a CVSS score of 7.5 and is classified as a high-severity information disclosure flaw, according to The Hacker News. An unauthenticated party that can reach the exposed management interface is able to request an authentication response and then test password guesses against it offline, without ever needing to log in first, The Hacker News reported. Per an advisory from Dell cited by the outlet, “this is an inherent problem with the specification for IPMI v2.0,” and the company said no patch is available.
Among the exposed hosts, 6,240 accepted empty usernames and 2,340 used administrator passwords that matched public wordlists, according to BleepingComputer. On a live exposure map reviewed by the outlet, the United States topped the list with 39% of the vulnerable servers, while The Hacker News reported that the remaining exposed systems are concentrated in Germany, China, the Netherlands, and the U.K.
Many exposed Supermicro systems use a factory-default, 10-character uppercase password printed on a chassis label alongside the username “ADMIN,” BleepingComputer reported. The outlet said researchers found those Supermicro factory passwords could be recovered in approximately one hour using modern GPU hardware. HPE’s factory-set iLO passwords were found to be recoverable within about a minute using modern GPU hardware, or in roughly a day using an Apple M3 chip per captured authentication response, according to BleepingComputer.
Researcher Michael Katchinskiy said “the exposure also affected modern Supermicro and HPE servers operated by GPU providers, including systems that were still using factory-issued passwords,” according to The Hacker News. BleepingComputer reported that researchers who conducted the study warned a single compromised BMC could serve as a pivot point into a broader management plane, raising particular concern for shared AI infrastructure where multiple tenants’ systems may sit on poorly segmented networks.
There is evidence the exposure is already being exploited: BleepingComputer reported that researchers found an internet-exposed HPE iLO 4 login page displaying a ransom note demanding 0.3 BTC.
On vendor response, BleepingComputer reported that Supermicro acknowledged the risk and said it would review stronger default password policies for future hardware revisions, while HPE responded only with a standard auto-response message and gave no follow-up from its security team.
What We Don’t Know
Neither outlet reported how many of the exposed BMCs sit inside networks that have already been breached as a result of this specific exposure, beyond the single ransom-note case identified during the research. It is also not stated how the researchers’ scan methodology defined “internet-exposed,” or whether the count includes systems behind carrier-grade NAT or other partial network protections that could complicate direct exploitation.
Recommended Mitigations
Both outlets reported the same core guidance: keep IPMI and Redfish management interfaces off the public internet, rotate factory-issued default passwords during provisioning, restrict BMC access to isolated management networks separate from production traffic, and disable legacy IPMI authentication where possible, according to BleepingComputer and The Hacker News.