Researchers at cybersecurity startup Lava have found more than 24,000 internet-exposed servers leaking authentication password hashes through their Baseboard Management Controller (BMC) interfaces. The culprit is CVE-2013-4786 — a weakness baked into the IPMI 2.0 protocol since 2004 that lets anyone request a password hash without logging in first.

Of the 24,650 exposed servers found via Shodan scans, researchers cracked the passwords on roughly a third using default credentials and public wordlists. Some were still using the factory password printed on the chassis sticker. At least one exposed HPE iLO instance was already displaying a ransom note.

Who’s affected

Any business running on-premises servers with a BMC — Supermicro, HPE iLO, Dell iDRAC — where the management interface is reachable from the internet. This isn’t as niche as it sounds. We regularly find IPMI ports left publicly exposed after network changes, ISP migrations, or handovers from a previous IT provider. It’s especially common in regional environments across Central West NSW and outer-metro Sydney, where server hardware has been in place for years without a proper infrastructure audit. A single compromised BMC gives an attacker full control of the physical server — firmware, boot sequence, virtual media — at a layer most security tools don’t monitor.

What to do now

Check whether UDP port 623 is open on your public IP range. If your BMC management interface is internet-facing, take it offline immediately and move it to an isolated management VLAN. Rotate every BMC password — especially if the factory default is still in use. Disable legacy IPMI authentication if your firmware supports Redfish.

If you’re not sure whether your server infrastructure is exposing management interfaces, get in touch. This is exactly the kind of misconfiguration a managed IT provider catches during a standard infrastructure review.