[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXH1piUDeUj4QJBzpcMaxA864OvUDz8klyvXePwOAtVQ":3},{"article":4,"iocs":53,"watch_terms":65,"solutions":66,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b61ebe26-2151-450e-89cc-68ff49297301","Over 24,000 exposed server BMCs leak password hash via decades-old flaw","over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw-ddb0db","More than 24,000 internet-exposed servers are leaking authentication password hashes due to a 20-year-old vulnerability in their Baseboard Management Controller (BMC) interface. [...]","Researchers discovered more than 24,000 internet-exposed Baseboard Management Controllers (BMCs) vulnerable to CVE-2013-4786, a 20-year-old IPMI 2.0 authentication weakness that leaks password-derived hashes usable for offline cracking. For at least 8,000 of the exposed servers, weak or default credentials were recoverable using dictionaries and factory default patterns, with the US hosting 39% of vulnerable systems. Access to compromised BMCs could allow attackers to pivot into management planes, apply malicious firmware, or disrupt multiple tenant workloads in virtualized environments.","Over 24,000 internet-exposed server BMCs leak password hashes via 20-year-old IPMI flaw.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fover-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F27\u002Fservers.jpg","2026-07-28T12:10:23+00:00","2026-07-28T14:00:08.627517+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"IPMI 2.0","technology",{"name":21,"type":19},"Baseboard Management Controller (BMC)",{"name":23,"type":24},"Supermicro","vendor",{"name":26,"type":24},"HPE",{"name":28,"type":24},"Lava",{"name":30,"type":31},"HPE iLO 4","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,62],{"type":55,"value":56,"context":57},"cve","CVE-2013-4786","IPMI 2.0 authentication weakness allowing offline password-cracking attacks via leaked authentication responses",{"type":59,"value":60,"context":61},"mitre_attack","T1078.001","Default Accounts: exploitation of weak\u002Fdefault BMC credentials",{"type":59,"value":63,"context":64},"T1556","Modify Authentication Process: IPMI protocol vulnerability allowing authentication bypass",[23,26,28],{"controls":67,"vendors":144},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":98,"name":99,"problem":100,"products":101},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"watchtowr","watchTowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":127,"name":128,"problem":129,"products":130},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[131,138,139],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":133,"url":136,"description":137},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":140,"product_name":141,"url":142,"description":143},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"24000-bmcs-exposed-by-11-year-old-ipmi-flaw-and-default-credentials","24,000+ BMCs Exposed by 11-Year-Old IPMI Flaw and Default Credentials","Over 24,000 internet-facing Baseboard Management Controllers remain vulnerable to CVE-2013-4786, a critical IPMI 2.0 flaw disclosed over a decade ago that leaks password hashes for offline cracking. At least 8,000 of these systems were further compromised by weak or default credentials, meaning attackers face minimal resistance in gaining full hardware-level control. BMCs operate below the operating system layer, making compromise extraordinarily difficult to detect and remediate once it occurs. This incident illustrates how out-of-band management interfaces are frequently overlooked in patch and hardening cycles, creating persistent, high-impact attack surfaces that can affect entire virtualized infrastructures.",[150,151,152,153,154,155,156,157,158,159,160],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 CM-6 (Configuration Settings)","NIST SP 800-53 AC-17 (Remote Access)","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST CSF ID.AM-1 (Asset Inventory)","NIST CSF PR.AC-5 (Network Integrity \u002F Segmentation)","ISO\u002FIEC 27001:2022 A.8.8 (Management of Technical Vulnerabilities)","ISO\u002FIEC 27001:2022 A.8.20 (Networks Security)",{}]