A two-decade-old vulnerability in the Intelligent Platform Management Interface (IPMI) protocol could allow attackers to gain control of thousands of publicly exposed data center servers in just minutes, researchers have warned.
The issue affects Baseboard Management Controllers (BMCs), which are privileged processors that enable administrators to manage physical servers remotely, even when the operating system is offline. BMCs can reboot systems, mount virtual media, access remote consoles, update firmware, and modify low-level hardware settings.
Researchers have identified 36,872 publicly accessible server management interfaces using IPMI on UDP port 623. Among these, 24,650 (66.9%) returned password-derived authentication data before a user successfully logged in.
This behavior is associated with CVE-2013-4786, a vulnerability in the IPMI 2.0 Remote Authenticated Key-Exchange Protocol authentication process. The flaw allows an unauthenticated attacker to obtain an HMAC-SHA1 value generated using a target account password.
IPMI port:623, showing publicly reachable IPMI services exposed on UDP port 623 ( source: Lavahq )Attackers can then attempt to recover the password offline, thereby avoiding repeated failed login attempts that typically trigger account lockouts or security alerts.
20-Year-Old Vulnerability Enables Data Center Takeover
The LavaHQ researchers stated that over 30% of the recovered authentication hashes were linked to weak, common, or easily guessable passwords. They found 6,240 interfaces that exposed authentication material for empty usernames combined with weak password candidates.
Additionally, 2,340 systems used named accounts, such as ADMIN or root, with passwords that were found in public wordlists. The exposed interfaces included modern systems from major vendors like Supermicro and HPE.
Some affected servers were operated by GPU and bare-metal cloud providers, where BMCs often reside on shared management networks that support large volumes of high-value AI infrastructure.
Supermicro systems accounted for more than half of the responding BMCs in the dataset. Since 2019, some Supermicro platforms have used unique factory passwords consisting of exactly ten uppercase letters printed on a chassis label.
Although these passwords are unique, the predictable format results in a limited search space of (26^{10}) combinations. Researchers noted that a targeted attacker with an eight-GPU system could search the entire password space in about an hour.
HPE iLO systems may face a similar risk, as factory-issued iLO credentials use eight uppercase letters and numbers, creating a keyspace of (36^{8}) combinations.
Researchers found that a modern multi-GPU system could search this space in roughly 32 seconds for a captured authentication response.
The consequences of a BMC compromise can be severe, as the controller operates below the server’s operating system and is largely invisible to most endpoint security tools.
An attacker with BMC access could power off systems, access virtual consoles, change firmware, steal data through mounted media, or establish persistence that survives operating system reinstallation.
The threat can also extend beyond a single server. In many environments, BMC interfaces share a management network with weak segmentation, reused credentials, and limited monitoring. A compromised controller may provide a pathway to additional BMCs, infrastructure services, and customer workloads.
LavaHQ researchers found evidence of active exploitation, with one internet-exposed HPE iLO interface displaying a ransom note demanding 0.3 BTC, suggesting attackers had compromised the management plane.
Organizations should immediately take steps to secure their systems by removing IPMI from the public internet, blocking UDP port 623, rotating all factory-issued BMC passwords, turning off insecure authentication options, and isolating BMCs on dedicated management networks. Access should be restricted through VPNs, bastion hosts, VLANs, and strict access control rules.
These findings highlight that legacy management protocols continue to pose significant risks to data centers. A publicly exposed BMC is not merely an administrative interface; it can serve as a silent yet highly privileged entry point into an entire infrastructure environment.
