24,000 Server Management Controllers Expose Password Hashes Online
More than 24,000 internet-exposed servers are leaking authentication password hashes due to a vulnerability that is over two decades old. The flaw, tracked as CVE-2013-4786, resides in the IPMI 2.0 protocol and allows attackers to request authentication responses that can be cracked offline using dedicated hardware. Cybersecurity startup Lava discovers that of the 36,8872 exposed hosts they find, over 24,000 leak password-derived material, and thousands accept weak or default credentials.
Baseboard Management Controllers, or BMCs, are embedded processors that allow administrators to remotely manage servers independently of the operating system. Gaining access to a BMC gives an attacker control over physical hardware, enabling them to power systems on or off, apply malicious firmware, and operate at a layer invisible to standard security tools. In poorly segmented environments such as shared AI infrastructure, compromising a single BMC could disrupt multiple tenants simultaneously.
The root cause of the exposure is the IPMI specification itself, which makes the weakness difficult to patch. Researchers recommend isolating BMC interfaces on dedicated management networks and never exposing them directly to the internet. Enforcing strong, unique passwords and monitoring access logs provide additional layers of defense against attackers seeking to exploit these widely accessible management interfaces.