Researchers at cybersecurity startup Lava have found more than 24,000 servers whose Baseboard Management Controller (BMC) interfaces are directly reachable over the internet — and all of them silently hand out crackable authentication hashes to any machine that asks. The underlying flaw, CVE-2013-4786, is rooted in how the IPMI 2.0 protocol handles authentication negotiation: a remote attacker can initiate an auth exchange and receive a hash they can crack offline, without ever supplying valid credentials first. For roughly a third of the exposed servers, the researchers recovered the actual password using dictionary lists and the credential patterns printed on factory default stickers.
BMCs sit below the operating system and let data center operators power servers on or off, update firmware, and mount virtual media remotely. They operate independently of the host OS, which means malware defenses running on the OS cannot detect or block access through this channel. If an attacker recovers BMC credentials, they can potentially apply malicious firmware, change low-level hardware configurations, and maintain persistent access to a physical server that survives even a full OS reinstall. The Lava researchers also note that recovered passwords often work across multiple management interfaces within the same environment, so a single cracked BMC credential can become a master key across an entire data center rack.
How to check if you’re affected
Affected products are servers with a BMC or IPMI 2.0 interface exposed on the public internet (TCP/UDP port 623). Administrators can check their firewall rules and cloud security groups to see whether port 623 is reachable from untrusted networks. Affected versions of the IPMI 2.0 specification include all implementations prior to any vendor patches addressing CVE-2013-4786. The safest remediation is to move BMC/IPMI access behind a dedicated out-of-band management network or a VPN, so that the interface is never reachable from the open internet regardless of the protocol version.