A critical vulnerability in the Intelligent Platform Management Interface (IPMI) protocol, dating back two decades, has been identified as a significant threat to data center security. This flaw enables attackers to gain control over thousands of publicly exposed servers within minutes.
IPMI is a standardized protocol that allows administrators to manage servers remotely, even when the operating system is offline. It facilitates tasks such as rebooting systems, accessing remote consoles, updating firmware, and modifying hardware settings. Central to IPMI’s functionality are Baseboard Management Controllers (BMCs), specialized processors that handle these remote management tasks.
Recent research has uncovered 36,872 publicly accessible server management interfaces utilizing IPMI on UDP port 623. Alarmingly, 24,650 of these interfaces (approximately 66.9%) transmit password-derived authentication data before a user successfully logs in. This behavior is linked to CVE-2013-4786, a vulnerability in the IPMI 2.0 Remote Authenticated Key-Exchange Protocol. Exploiting this flaw, an unauthenticated attacker can obtain an HMAC-SHA1 value generated using a target account’s password.
With this authentication data in hand, attackers can perform offline password cracking, circumventing traditional security measures that detect repeated failed login attempts. The research revealed that over 30% of the recovered authentication hashes corresponded to weak or easily guessable passwords. Specifically, 6,240 interfaces exposed authentication material for empty usernames combined with weak passwords, and 2,340 systems used common account names like ‘ADMIN’ or ‘root’ with passwords found in public wordlists.
The affected systems include modern servers from major vendors such as Supermicro and HPE. Notably, Supermicro systems often use factory-set passwords consisting of ten uppercase letters, resulting in a limited search space of 26^10 combinations. An attacker equipped with an eight-GPU system could potentially brute-force this password space in about an hour. Similarly, HPE’s Integrated Lights-Out (iLO) systems use factory-issued credentials with eight-character alphanumeric passwords, creating a keyspace of 36^8 combinations. A modern multi-GPU system could exhaust this space in approximately 32 seconds.
The implications of a BMC compromise are severe. Operating below the server’s operating system, BMCs are typically invisible to standard endpoint security tools. An attacker with BMC access could power off systems, access virtual consoles, alter firmware, steal data through mounted media, or establish persistent access that survives operating system reinstallation. Furthermore, in many environments, BMC interfaces share a management network with weak segmentation and reused credentials, potentially allowing a compromised controller to serve as a gateway to additional BMCs, infrastructure services, and customer workloads.
Evidence of active exploitation has been observed. For instance, an internet-exposed HPE iLO interface displayed a ransom note demanding 0.3 BTC, indicating that attackers had compromised the management plane.
This discovery underscores the critical importance of securing remote management interfaces. Organizations should immediately assess their exposure to this vulnerability, implement robust password policies, and consider disabling or restricting IPMI access where possible. Regularly updating firmware and applying security patches are essential steps in mitigating such longstanding vulnerabilities.
