Cybersecurity researchers are sounding the alarm over a widespread exposure of **Baseboard Management Controller (BMC)** management interfaces, with over 36,000 found to be publicly accessible via the internet. Of these, a staggering 24,650 are susceptible to an information disclosure vulnerability within the **IPMI v2.0** specification itself, according to a new report by **Lava**. ## The Persistent Threat of CVE-2013-4786 The vulnerability in question is **CVE-2013-4786** (CVSS score: 7.5), a high-severity flaw dating back to 2013. It enables remote attackers to obtain password hashes for valid accounts before login, facilitating offline password guessing attacks. This is achieved by extracting the HMAC from an **RMCP+ Authenticated Key-Exchange Protocol (RAKP)** message response from a BMC. **Dell** has acknowledged this as an inherent problem with the **IPMI v2.0** specification, noting that no patch is available. > "More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats," stated security researcher **Michael Katchinskiy**. "The exposure also affected modern **Supermicro** and **HPE** servers operated by GPU providers, including systems that were still using factory-issued passwords." ## The Critical Role of BMCs BMCs are specialized management processors embedded on server motherboards. They are crucial for remote data center automation, controlling power, firmware, remote console access, OS installation, and system recovery. They typically communicate using protocols like **IPMI** and **Redfish**.  Their privileged position, operating independently of the host OS (Out-of-Band management), makes them prime targets for attackers. A compromised BMC can bypass traditional security controls, persist through OS reinstalls, and maintain access. "In modern AI data centers, where the same bare-metal environment often hosts multiple tenants, a single exposed BMC can potentially place multiple organizations' workloads at risk through shared infrastructure or lateral movement, making this a significant blind spot in the infrastructure underpinning the AI data center boom," the Israeli company **Lava** highlighted. ## Escalating Risk and Real-World Impact **CVE-2013-4786** itself isn't new, but the risk profile has drastically changed. The advent of modern GPU cracking has significantly accelerated offline password recovery. Furthermore, the increasing value of bare-metal environments, especially in AI infrastructure, makes each exposed server a more lucrative target. As of May 6, 2024, a scan of the public internet revealed 36,872 unique hosts exposing **IPMI** services on UDP port 623. Over 14,000 of these are in the U.S., with others concentrated in Germany, China, the Netherlands, and the U.K. Nearly 25,000 of these systems disclosed password-derived authentication materials before login. Alarmingly, 6,240 BMCs returned authentication material for an empty username matching a weak password, and 2,340 for named accounts like 'ADMIN' or 'root' matching publicly available wordlists. Tests conducted by **Lava** demonstrated that **HPE iLO** factory passwords could be recovered within a minute using modern GPU hardware. **Supermicro** factory passwords, despite being uniquely assigned, were recoverable in approximately an hour. **Supermicro** has stated it will evaluate improvements to its default password policy for future hardware revisions. Evidence suggests threat actors are already exploiting these exposures. Ransomware operators have been observed leaving extortion notes on **HPE iLO 4** login pages. Notably, **HPE iLO** servers have been targeted since 2020 with rootkits like **iLOBleed**.  ## Mitigation Strategies for IT Security Professionals To counter this significant risk, IT security professionals are advised to implement several critical measures: * **Block UDP port 623** at the network edge. * **Rotate factory-issued passwords** during server provisioning. * **Disable legacy or weak options**, such as **IPMI 1.5**. * **Restrict BMC access** to a dedicated private management network. * **Apply network access controls** to ensure only approved administrative systems can reach BMC interfaces. "Organizations have spent years hardening cloud workloads and operating systems, but many have overlooked the infrastructure that sits beneath them," said **Yakir Kadkoda**, CTO and co-founder at **Lava**. "These management controllers hold the keys to servers and data centers. Once compromised, attackers can operate below the visibility of almost any security tools, maintain persistence even after systems are rebuilt, and potentially move deeper into critical infrastructure. As AI infrastructure rapidly expands, securing this layer has become far more urgent."