24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
Summary: Lava researchers found 36,872 internet-exposed BMC interfaces running IPMI, of which 24,650 disclose password-derived authentication hashes before login through CVE-2013-4786, a flaw Dell describes as inherent to the IPMI v2.0 specification with no patch. Of the returned hashes, more than 30% matched passwords recoverable from common wordlists and factory chassis-sticker formats, and 6,240 BMCs returned authentication material for an empty username while 2,340 returned data for named accounts such as ADMIN or root.
What's compelling: Lava recovered HPE iLO factory passwords in under a minute on modern GPU hardware and Supermicro factory passwords in about an hour, and ransomware operators have already left an extortion note on an HPE iLO 4 login page. A compromised BMC runs out-of-band from the host OS, so it survives reinstalls and sits below the visibility of most security tools - and in multi-tenant AI data centers, one exposed controller can put several organizations' workloads at risk.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-4786
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026