Over 24,000 exposed server BMCs leak password hash via decades-old flaw
Over 24,000 internet-exposed server BMCs leak password hashes via 20-year-old IPMI flaw.
Researchers discovered more than 24,000 internet-exposed Baseboard Management Controllers (BMCs) vulnerable to CVE-2013-4786, a 20-year-old IPMI 2.0 authentication weakness that leaks password-derived hashes usable for offline cracking. For at least 8,000 of the exposed servers, weak or default credentials were recoverable using dictionaries and factory default patterns, with the US hosting 39% of vulnerable systems. Access to compromised BMCs could allow attackers to pivot into management planes, apply malicious firmware, or disrupt multiple tenant workloads in virtualized environments.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Supermicro?
Get an email when a new story names Supermicro, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOver 24,000 internet-facing Baseboard Management Controllers remain vulnerable to CVE-2013-4786, a critical IPMI 2.0 flaw disclosed over a decade ago that leaks password hashes for offline cracking. At least 8,000 of these systems were further compromised by weak or default credentials, meaning attackers face minimal resistance in gaining full hardware-level control. BMCs operate below the operating system layer, making compromise extraordinarily difficult to detect and remediate once it occurs. This incident illustrates how out-of-band management interfaces are frequently overlooked in patch and hardening cycles, creating persistent, high-impact attack surfaces that can affect entire virtualized infrastructures.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2013-4786
- mitre_attack — T1078.001
- mitre_attack — T1556