{"id":16521,"date":"2026-07-29T01:35:57","date_gmt":"2026-07-29T01:35:57","guid":{"rendered":"https:\/\/newestek.com\/?p=16521"},"modified":"2026-07-29T01:35:57","modified_gmt":"2026-07-29T01:35:57","slug":"a-13-year-old-flaw-is-exposing-tens-of-thousands-of-data-center-management-systems","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16521","title":{"rendered":"A 13-year-old flaw is exposing tens of thousands of data center management systems"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

The \u2018no man\u2019s land\u2019 beneath the OS on enterprise servers is becoming the malicious actors\u2019 next target.<\/p>\n

Attackers are gaining a foothold into broader data center environments by exploiting Baseboard Management Controllers (BMCs) that are largely unprotected, still running decades-old protocols and susceptible to a vulnerability published 13 years ago, according to data center security company Lava.<\/p>\n

Lava\u2019s red team researchers were able to hack into BMCs<\/a>, which provide out-of-band remote control over servers without the need for physical access, within minutes by guessing basic passwords. BMCs on Supermicro and HPE servers were among the most impacted.<\/p>\n

\u201cBMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage,\u201d Michael Katchinskiy<\/a>, Lava\u2019s head of security research, explained in a blog post<\/a>. \u201cMost security tools monitor the operating system, kernel, containers, and workloads.\u201d <\/p>\n

But BMCs operate outside that trust boundary, he said, \u201cgiving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.\u201d<\/p>\n

How attackers can exploit BMC weaknesses<\/h2>\n

As the name \u2018baseboard\u2019 would imply, BMCs are specialized micro-controllers embedded in server platforms that operate independently of the host system\u2019s main CPU, memory, and operating system (OS). This gives admins the ability to do out-of-band management and troubleshooting of servers, update firmware, change configurations, and read hardware sensors, among other actions.<\/p>\n

\u201cIn practice, the BMC is one of the most privileged control points in a data center,\u201d Katchinskiy noted.<\/p>\n

But BMCs can expose management planes such as the 22-year-old out-of-band IPMI, the newer HTTPS-based Redfish, browser-based admin interfaces, and remote console features. In many cases, these share the same database and even the same credentials.<\/p>\n

The culprit enabling the current attacks is a vulnerability in the IPMI 2.0 authentication protocol<\/a>, tracked as CVE-2013-4786<\/a>, that was published in 2013.<\/p>\n

Lava\u2019s researchers discovered 36,872 BMCs reachable from the public internet still exposing IPMI. Of those, 66% (24,650) disclosed authentication hashes, scrambled versions of passwords that are stored and later used to authenticate users. Hackers can take them offline to examine and recover original passwords.<\/p>\n

The researchers tested hashes against common wordlists and found that more than 30% of the hashes were linked to \u201creused, factory-set, or predictably formatted\u201d passwords. These matches were discovered in minutes, and often during the first pass. And nearly 17% of BMCs accepted an empty username field with a weak password.<\/p>\n

Interestingly, Supermicro<\/a>, which is in wide use across data centers, GPU infrastructures, and hosted environments, accounted for more than half of responding BMCs, but their credentials did not match passwords in the researchers\u2019 wordlist.<\/p>\n

This was \u201cexpected,\u201d the researchers note, because in 2019 Supermicro replaced a shared admin password on impacted products with unique, factory-issued passwords which consisted of 10 uppercase letters printed on a chassis label.<\/p>\n

The researchers reported their findings to impacted parties and to Supermicro, which said it would review potential improvements to its default password policy for future hardware revisions. Lava said that Supermicro has since fixed the exposure. <\/p>\n

Lava has also created an interactive map of the internet-exposed BMCs it uncovered.<\/p>\n

Why this attack method is dangerous<\/h2>\n

BMCs sit a layer below that which many security products monitor, on shared out-of-band management networks where administrative credentials are often reused. Thus, malicious changes made to BMCs or other platform hardware are able to survive OS reinstalls, disk replacements, and standard incident response procedures, Katchinskiy noted.<\/p>\n

The risk is \u201cespecially pronounced\u201d in neocloud and GPU cloud environments, he said. AI infrastructure can span thousands of GPUs on shared management networks, with joint storage, high-speed interconnects, and multi-tenant tooling.<\/p>\n

He pointed out that, while a customer may rent their own dedicated servers, they are still connected to shared, provider-managed, out-of-band networks where orchestration and provisioning services, credential stores, and admin tools span infrastructure used by numerous joint customers.<\/p>\n

That means, he noted, that the risk extends well beyond a single server, and attackers can gain a foothold to reach larger portions of data center infrastructure.<\/p>\n

In the environments examined, BMC management networks \u201clacked effective segmentation, access controls, and monitoring,\u201d Katchinskiy said. \u201cA single compromised BMC can therefore become a path to additional servers, critical infrastructure, and customer workloads.\u201d<\/p>\n

Why BMCs are so often overlooked<\/h2>\n

There are \u201ccountless examples\u201d of hardware and software tools that don\u2019t get patched because IT or security teams determine that, while they are vulnerable, threat actors can\u2019t exploit them, noted David Shipley<\/a> of Beauceron Security. For instance, there\u2019s a commonly-held notion that if a server or piece of software is air-gapped, meaning it is not network connected or not connected to the internet, it is safe.<\/p>\n

\u201cIf it\u2019s overlooked, it\u2019s likely because it sits in this weird in-between space between teams,\u201d he said. It\u2019s not really part of networking, and it exists before the OS is booted, so it\u2019s not under the domain of the system administrators.<\/p>\n

Thus, getting access is \u201cso simple,\u201d Shipley noted, and attackers can do \u201call kinds of not fun things in theory.\u201d<\/p>\n

For instance, they can power off devices, which can shut down a company\u2019s servers. Second, they could potentially take control of a server by \u201creimaging it and having their own OS in play,\u201d although that should be detected pretty quickly, he pointed out. Third, they can be persistent.<\/p>\n

\u201cIt gives them a place to live on a network and think about finding other holes to exploit as vulnerabilities,\u201d said Shipley.<\/p>\n

A \u2018simple fix\u2019<\/h2>\n

There\u2019s a \u201csimple\u201d fix to this problem, according to Katchinskiy: IPMI and Redfish should never be exposed to the public internet.<\/p>\n

To keep attackers out of BMCs, defenders should:<\/p>\n