Researchers at Lava have found 36,872 server management interfaces reachable from the public internet, two thirds of which hand over password-derived authentication material to anyone who asks, before any login completes.
The cause is CVE-2013-4786, a weakness in the authentication protocol of IPMI 2.0, a server management specification introduced in 2004. Anyone who can reach UDP port 623 can collect a password-derived value once and test guesses offline, without the repeated failed logins that would normally raise an alert.
For context, Baseboard Management Controllers (BMCs) are processors built into server motherboards that let administrators power machines on and off, mount virtual media and update firmware without touching the OS.
Unique Factory Passwords Did Not Help
Supermicro hardware accounted for more than half the responding controllers. Since November 2019 the company has shipped affected products with a unique preprogrammed password, rather than a shared default: ten uppercase letters printed on a chassis label.
That format still proved recoverable. Lava calculated the keyspace as searchable in roughly an hour on an eight-GPU server, and confirmed it against two systems at a US GPU provider whose published policy permitted testing. HPE iLO’s shorter format took around 32 seconds per captured response.
Supermicro, notified in June, acknowledged the scenario is plausible given modern multi-GPU cracking and said it will review the default password policy for future hardware.
Lava also found one exposed HPE iLO 4 login page carrying a ransom message demanding 0.3 BTC. It could not confirm the server’s data had been encrypted, but the modified page showed someone had reached the management interface.
A Foothold Below the Operating System
Darren Guccione, CEO and co-founder at Keeper Security, told Expert Insights a BMC matters because it sits beneath the host operating system entirely, controlling power, firmware updates and remote access at the hardware layer.
“When an attacker gains access to a BMC, they have a foothold that survives reimaging, persists across software patches and effectively hands them hardware-level control of the machine,” he said.
Mark Stockley, cybersecurity evangelist at ThreatDown, told Expert Insights the flaw also shows how hard BMC patching is.
Because the controllers are built into motherboards and manage systems that administrators often cannot physically reach, teams are wary of firmware updates that might sever remote access. Every vendor implementing the protocol is affected, he said, but there is no universal update mechanism and no agreement on the fix.
“The BMC flaw shows just how long the long tail of patching is, and how dangerous that technical debt is becoming in a world where AI models can now expose and exploit software flaws faster and more effectively than humans,” he added.
Lava’s guidance is blunt: IPMI should not be reachable from the public internet. Operators should block UDP port 623 at the edge and move controllers onto a dedicated management network.
