Press play to start listening
A server management feature designed to work when a computer’s operating system is unavailable is exposing password-derived authentication data on thousands of internet-facing systems, according to new research from Lava.
Researchers identified 36,872 publicly accessible Baseboard Management Controller (BMC) interfaces using the Intelligent Platform Management Interface (IPMI). Of those, 24,650 returned password-derived authentication data without requiring successful authentication.
BMC Access Gives Extensive Control Over Servers
A BMC is a small management computer built into a server’s motherboard. Administrators use it to restart machines, open remote consoles, install operating systems, update firmware, and inspect hardware, even when the main server is switched off or unresponsive.
Those capabilities make exposed BMC interfaces high-value targets. Someone who obtains valid login credentials may be able to control the physical server from outside its operating system, where endpoint security software has limited visibility.
Lava traced the exposure to CVE-2013-4786, a weakness in IPMI 2.0 authentication. The protocol was introduced in 2004, while the vulnerability received its CVE identifier in 2013.
When an attacker starts an authentication request, a vulnerable BMC returns a cryptographic response derived from the account password. The response does not reveal the password in readable form, but it allows password guesses to be tested offline without repeatedly contacting the server.
Weak and Factory Passwords Were Recovered
Weak credentials made many of the captured responses practical to crack. Lava found 6,240 controllers that accepted an empty username and produced authentication data matching a weak password during offline testing.
Another 2,340 systems had named accounts, including ADMIN or root, whose passwords matched entries in public password dictionaries. Researchers said many of these passwords were recovered within minutes.
Factory credentials were also vulnerable even when each server had received a different password. Some Supermicro systems use ten uppercase letters printed on a chassis sticker, while certain HPE iLO systems use eight uppercase letters and numbers. Knowing these fixed formats reduces the number of password combinations that need to be tested.
During authorized testing, Lava recovered factory-format passwords for two modern Supermicro servers operated by a GPU provider. Researchers did not use the passwords to log in or alter the systems, and the provider removed the exposure after being notified.
Lava also reproduced the attack on an HPE server in its own laboratory. The full research says more than 30% of the returned hashes were associated with passwords recoverable through common wordlists or predictable factory formats.
In a comment to Hackread.com, ThreatDown cybersecurity evangelist Mark Stockley said BMC security is difficult to manage because the controllers are built into motherboards, firmware procedures differ between vendors, and maintenance can interrupt remote access to important systems. He noted that the flaw comes from the IPMI protocol itself, leaving operators without one universal update that fixes every implementation.
Public IPMI Access Should Be Removed
Lava researchers recommend blocking public access to UDP port 623 and placing BMC interfaces on private management networks reachable only through a VPN, bastion host, or approved administrative system.
They also recommend replacing factory credentials, disabling anonymous accounts and weak IPMI options, applying vendor firmware updates where available, and monitoring management networks separately from normal server traffic.
Because CVE-2013-4786 stems from the IPMI 2.0 authentication protocol itself, mitigation may require disabling IPMI over LAN or restricting access rather than relying on a software patch alone.
