More than 24,000 internet-exposed servers are leaking authentication password hashes due to a decades-old vulnerability in their Baseboard Management Controller (**BMC**) interface. For at least a third of these systems, researchers were able to identify the correct password using dictionary attacks and patterns derived from factory default credentials. The exposed servers are vulnerable to **CVE-2013-4786**, an **IPMI 2.0** authentication weakness rooted in a protocol introduced in 2004. This security flaw allows attackers to request an authentication response that can be subsequently used for offline password cracking with dedicated GPU rigs or similar high-performance setups. ### BMCs and Server Risks BMCs are specialized processors integrated into server motherboards, enabling administrators to remotely manage the system independently of the operating system. They facilitate low-level operations such as powering servers on/off, updating firmware, or mounting virtual media. Unauthorized access to BMCs grants attackers profound control over physical servers. This includes the ability to alter low-level configurations, deploy malicious firmware updates, and compromise the system at a foundational layer that often bypasses conventional security monitoring solutions. Researchers at cybersecurity and infrastructure startup **Lava** emphasize that in real-world scenarios, recovered credentials could function across multiple management interfaces within the same environment. A single compromised BMC might therefore serve as a critical pivot point to infiltrate the broader management plane. In **AI** environments with inadequate infrastructure segmentation, attackers could potentially impact numerous tenants simultaneously. “A physical GPU server can support multiple tenants or workloads through virtualization, GPU partitioning, or other sharing mechanisms,” **Lava** researchers state. “In those environments, compromise of one physical server could disrupt or expose several customer workloads.” .jpg) ### Massive Exposure By scanning for publicly accessible **IPMI** services on UDP port 623, the researchers identified 36,872 internet-exposed hosts. Of these, 24,650 exposed password-derived authentication material susceptible to offline password-cracking attacks. According to **Lava**, 6,240 of these hosts accepted an empty username during authentication, and subsequent testing confirmed they were protected by weak passwords. An additional 2,340 instances utilized weak administrator passwords that matched public dictionaries, rendering them highly vulnerable. An exposure map observed by BleepingComputer indicates that the United States accounts for the largest share of vulnerable servers, with 39%. **Lava** researchers noted that a significant number of the exposed BMCs are **Supermicro** systems, often protected by a 10-character uppercase password printed on the chassis label, typically with the username ‘ADMIN’. While this format theoretically offers robust security, its constrained structure still makes offline cracking feasible. For context, the researchers estimated that recovering an **HPE** factory password could take approximately one day per captured response (an authentication response obtained during the **IPMI** handshake) on an **Apple M3** system.  ### Activity and Response During their investigation, **Lava** identified an internet-exposed **HPE iLO 4** login page displaying a ransom note demanding 0.3 **BTC**. While this does not definitively prove widespread exploitation or successful attacks, it suggests that malicious actors are actively targeting these vulnerabilities.  **Lava** notified **Supermicro** in June. The company acknowledged the risk but reiterated that its official guidance recommends administrators rotate default BMC passwords and isolate management networks. **Supermicro** did, however, commit to reviewing stronger default password policies for future hardware revisions. **Lava** also informed **HPE** but received only an automated response without further follow-up from the vendor's security team. The researchers strongly recommend several mitigation strategies: keeping **IPMI** and **Redfish** interfaces off the public internet, rotating factory BMC passwords, restricting access to isolated management networks, and disabling legacy **IPMI** authentication.