IPMI bug in BMCs found after 22 years, exposes 24,000-plus servers

More than 24,000 servers exposed to the public internet are leaking authentication password hashes because of a 22-year-old bug in their Baseboard Management Controllers (BMCs), according to researchers at Lava.

In a July 29 blog post, the Lava researchers said the leaks were caused by an authentication weakness in the Intelligent Platform Management Interface 2.0 (IPMI 2.0), which was originally introduced in 2004.

While the actual bug dates back more than 20 years, the CVE wasn’t formally cataloged as CVE-2013-4786 until many years later.

Security pros were concerned because a BMC operates as a remote control system embedded directly into the server motherboard. It can power the server on or off, provide console access, mount virtual media, change firmware, and operate even when the operating system is unavailable.

“For an attacker, compromising the BMC is close to gaining physical access to the server, often beneath the visibility of endpoint security tools,” explained Kevin Surace, chief executive officer at TokenCore. “The industry documented the danger in 2013, but the architectural weakness had already existed for nearly a decade.”

Surace said an attacker can take the hash offline and test password guesses without triggering thousands of failed login alerts. If it’s a weak password, predictable, factory assigned, or reused, Surace said the attacker can recover it and gain extraordinary control over the physical server.

“That can include shutting systems down, mounting malicious software, changing firmware, establishing persistence beneath the operating system, and moving through the broader management network,” said Surace. “Many BMCs are installed, configured once, and then largely forgotten because they sit outside normal operating system and application security programs.”

Justin Beals, founder and CEO at Strike Graph, added that an attacker who cracks a BMC password isn't fighting our endpoint detection or network monitoring — they’re operating underneath it.

Beals said the gap between the design flaw and the CVE disclosure matters because it shows this isn't something we patch once and move on from: it's an architectural weakness that keeps producing new findings on the same 20-year-old foundation, and one-third of the affected servers are still sitting on default or dictionary-crackable passwords more than a decade after the CVE existed.

“The real failure isn't that IPMI has a known weakness,” said Beals. “It's that BMCs almost never show up in a normal vulnerability scan or asset inventory. Security teams patch operating systems and applications. They rarely touch the management chip sitting beneath them, and vendor response so far reflects that gap.”

Chris Jacob, Field CISO at Securonix, said there’s no good reason for this management layer to be exposed to the public internet.

“Security teams should find every BMC, establish who owns it, remove unnecessary external access, rotate credentials, isolate the management network, and look for evidence of prior abuse,” said Jacob. “Twenty years is more than enough time for a hidden infrastructure problem to become an active security risk."