Recent cybersecurity research has uncovered a significant vulnerability affecting Baseboard Management Controllers (BMCs) that are accessible via the public internet. BMCs are specialized processors embedded on server motherboards, enabling remote management tasks such as power control, firmware updates, and system monitoring. They communicate using protocols like the Intelligent Platform Management Interface (IPMI) and Redfish.
A study identified 36,872 BMC management interfaces exposing the IPMI protocol online. Alarmingly, 24,650 of these interfaces disclose password-derived authentication hashes before login, due to a flaw inherent in the IPMI v2.0 specification. This issue, cataloged as CVE-2013-4786 with a CVSS score of 7.5, allows remote attackers to obtain password hashes and perform offline password guessing attacks by intercepting specific authentication messages from the BMC.
During the authentication process, the BMC can return a message containing an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester. An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline. Unlike repeated online login attempts, the offline process does not require a new request to the BMC for every password candidate.
Further analysis revealed that over 30% of the exposed password hashes corresponded to passwords recoverable using common wordlists and predictable factory-set formats. Notably, modern servers from manufacturers like Supermicro and HPE, including those operated by GPU providers, were found to be using default passwords, exacerbating the risk.
The implications of this vulnerability are profound. BMCs operate independently of the host operating system, a feature known as Out-of-Band (OOB) management. This independence means that if a BMC is compromised, attackers can bypass traditional security controls, persist through operating system reinstalls, and maintain long-term access to the server. In environments like AI data centers, where multiple tenants share the same infrastructure, a single exposed BMC can jeopardize the workloads of multiple organizations, highlighting a critical blind spot in modern data center security.
Given the severity of this issue, organizations are urged to take immediate action. Recommendations include:
- Ensuring that BMC interfaces are not exposed to the public internet.
- Changing default or factory-set passwords to strong, unique credentials.
- Regularly updating BMC firmware to the latest versions provided by manufacturers.
- Implementing network segmentation to restrict access to management interfaces.
While the IPMI v2.0 specification’s inherent flaw cannot be patched, these proactive measures can significantly mitigate the associated risks. As data centers continue to evolve and expand, especially in the realm of AI and cloud computing, securing BMCs becomes paramount to maintaining the integrity and confidentiality of critical systems.
