24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Over 36,000 Baseboard Management Controllers (BMCs) are exposed on the internet, with 24,650 leaking IPMI password-derived authentication hashes due to a flaw in the IPMI v2.0 specification. The vulnerability, identified as CVE-2013-4786, allows unauthenticated remote attackers to obtain HMAC-SHA1 hashes via UDP port 623 and perform offline password cracking. Many affected systems use weak or factory-default passwords, increasing the risk of compromise. Threat actors have already been observed targeting exposed BMCs, including HPE iLO interfaces, highlighting the urgency of securing out-of-band management infrastructure.

AI-extracted · verify before operational use