More than 24,000 internet‑exposed servers are leaking authentication password material because of a two‑decade‑old weakness in their Baseboard Management Controller (BMC) interfaces, researchers say.
CVE-2013-4786 and the IPMI 2.0 authentication flaw
The vulnerability at the center of the exposure is tracked as CVE-2013-4786 and traces back to weaknesses in IPMI 2.0, a protocol introduced in 2004. Lava, a cybersecurity and infrastructure startup, found that the flaw allows an attacker to request an authentication response during the IPMI handshake. That response can be captured and used to crack the target device’s password offline with dedicated GPU rigs or similar setups.
What BMC access enables attackers to do
BMCs are processors mounted on server motherboards that permit remote management independent of the host operating system. They support low‑level actions such as powering systems on and off, updating firmware, and mounting virtual media. Lava warns that access to a BMC can let an attacker change low‑level configurations, apply malicious firmware updates, and otherwise compromise a system at a layer that many security solutions do not monitor.
Scope and scale: how many, and how weak the passwords are
Researchers scanned for publicly accessible IPMI services on UDP port 623 and identified 36,872 internet‑exposed hosts. Of those, 24,650 exposed password‑derived authentication material that could be used in offline cracking attacks. Lava reports that 6,240 hosts accepted an empty username during authentication; subsequent testing showed these were also protected by weak passwords. A further 2,340 hosts used weak administrator passwords that matched public dictionaries, making successful breaches very easy.
On a live exposure map seen by BleepingComputer, the United States accounted for 39% of the vulnerable servers. Lava also notes a pattern among many of the exposed devices: a large number are Supermicro systems using a 10‑character uppercase factory password printed on the chassis label and the username 'ADMIN' in all instances. While the format offers a theoretical password space, Lava found the constrained structure made offline cracking practical; for comparison, the team estimated recovering an HPE factory password would take about one day per captured response on an Apple M3 system.
Evidence of malicious activity and vendor responses
During their research, Lava found an internet‑exposed HPE iLO 4 login page displaying a ransom note demanding 0.3 BTC. The researchers stressed this is not proof of widespread exploitation or successful takeover, but it does indicate at least some malicious activity against exposed interfaces.
Lava notified Supermicro in June. Supermicro acknowledged the risk and pointed to its official guidance recommending rotation of default BMC passwords and isolation of management networks; the company also said it would review stronger default password policies for future hardware revisions. Lava reports that it notified HPE as well but received only a standard auto‑response and no follow‑up from the vendor’s security team.
What this means for technologists, Supermicro and HPE, and AI hosts
- Technologists and security teams: Lava recommends keeping IPMI and Redfish services off the public internet, rotating factory BMC passwords, restricting management interfaces to isolated networks, and disabling legacy IPMI authentication. The finding that many hosts accept empty usernames or dictionary passwords highlights the need for immediate credential hygiene and network segmentation.
- Supermicro and HPE: For Supermicro, Lava’s disclosure prompted acknowledgment and a pledge to review default password policies; administrators are being reminded to rotate defaults and isolate management ports. HPE was notified but did not provide a substantive response to Lava beyond an automated acknowledgement, leaving unanswered questions about vendor remediation communication.
- AI and multi‑tenant GPU hosts: Lava warns that in poorly segmented AI environments a compromised physical GPU server can support multiple tenants through virtualization, GPU partitioning, or other sharing mechanisms, potentially allowing attackers to disrupt or expose several customer workloads from a single compromised BMC. The researchers explicitly note that recovered credentials may work across multiple management interfaces within the same environment and that a single compromised BMC could be used to pivot across the broader management plane.
The vulnerability is old, the exposure is large, and the tools to exploit the leakable authentication material are straightforward for an attacker with offline cracking resources. Lava’s findings make plain that preventive steps — removing management interfaces from public networks, rotating factory credentials, and disabling legacy authentication modes — remain essential. Vendor engagement has been mixed: one major supplier acknowledged the risk and reiterated existing guidance, while another provided only an automated response to the disclosure. How quickly exposed hosts are remediated, and whether vendor defaults are changed for future hardware, will determine whether this decade‑old protocol continues to be a practical avenue for attackers.
