A 20-year-old flaw in the IPMI 2.0 protocol has left over 24,000 servers vulnerable to password cracking, potentially giving attackers full remote control.

Key Takeaways

  • A 20-year-old vulnerability (CVE-2013-4786) in IPMI 2.0 is leaking password hashes.
  • More than 24,000 servers are directly exposed to the public internet.
  • Attackers can use GPU rigs to crack passwords offline using intercepted responses.
  • Compromised BMCs can allow attackers to bypass OS-level security entirely.

In a major security revelation, researchers have identified that over 24,000 internet-exposed servers are leaking authentication password hashes. This massive exposure stems from a vulnerability in the Baseboard Management Controller (BMC) interface, rooted in a protocol that dates back to 2004.

The flaw, identified as CVE-2013-4786, involves a weakness in the IPMI 2.0 authentication process. This allows malicious actors to request an authentication response, which can then be used to perform offline password-cracking attacks using high-powered GPU rigs. For nearly a third of the exposed systems, researchers successfully recovered the actual passwords using simple dictionary attacks and factory default patterns.

Why This Matters

BozokMedia analysis shows that the risk extends far beyond a single compromised machine. BMCs are specialized processors that allow administrators to manage servers remotely, independent of the operating system. Because they operate at a low level, a compromised BMC can allow an attacker to install malicious firmware, change hardware configurations, or pivot to the broader management network.

A single compromised BMC could serve as a pivot point to the broader management plane, potentially disrupting multiple tenant workloads in shared AI environments.

The scale of the exposure is significant. Out of 36,872 hosts found with publicly accessible IPMI services, 24,650 were leaking sensitive authentication material. Notably, the United States accounts for 39% of these vulnerable instances. Researchers also observed real-world exploitation, including a ransom note found on an exposed HPE iLO 4 login page demanding 0.3 BTC.

Historical Background

The Intelligent Platform Management Interface (IPMI) was designed to provide out-of-band management capabilities for servers. However, the security standards of the early 2000s did not anticipate the computational power available to modern hackers, making legacy protocols like IPMI 2.0 a significant liability in today's hyper-connected world.

Frequently Asked Questions

1. What is a BMC?
A Baseboard Management Controller is a hardware component that allows remote management of a server, even if the operating system is crashed or turned off.

2. How can administrators mitigate this risk?
Administrators should keep IPMI/Redfish services off the public internet, rotate all factory default passwords, and use isolated management networks.

Did You Know?: Some manufacturers, like Supermicro, have historically used simple 10-character passwords printed directly on the server chassis labels!