Security
BMC flaws leave thousands of servers open to backdoors
Black Hat research found critical BMC flaws across major server vendors, with 86,000 exposed online and 75,000 vulnerable to a 2013 bug.
More than 86,000 internet-connected baseboard management controllers (BMCs) expose management services publicly, and over 54% of them contain at least one critical vulnerability, according to research presented at the Black Hat security conference in Las Vegas. As many as 75,000 remain vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that enables offline cracking of administrator-level BMC passwords.
BMCs are miniature computers built into the motherboards of enterprise servers. They run their own operating system, firmware, network stack, and IP address, allowing administrators to monitor hardware, reboot machines, install updates, or reinstall operating systems even when the host server is powered off or unresponsive.
That independence also creates a second route into the data center. Security researchers have warned since at least 2013 that vulnerable BMCs can let attackers execute code on the management controller, install persistent firmware, and then tamper with the server it controls.
BMC flaws affect major server vendors
HD Moore, a firmware security expert and founder and CEO of runZero, found more than a dozen new vulnerabilities across BMC products from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and other manufacturers. Some weaknesses disclosed in 2013 are still active despite attempted fixes.
“The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize.”
— HD Moore, founder and CEO, runZero
Moore’s second scan surveyed 126,761 BMCs inside corporate networks and found that nearly 29% had one or more critical vulnerabilities. The research did not provide a final count of the newly discovered bugs because Moore is withholding details while vendors prepare patches.
The vulnerability classes include:
- Authentication bypasses: Attackers can alter the IPMI handshake to avoid required authentication. The affected products include HPE iLO, Supermicro, OpenBMC, and OpenBMC-derived products from H3C and Nvidia.
- Broken session protections: Some devices decide whether to authenticate or decrypt a packet using attacker-controlled header information rather than the algorithms negotiated for the session. Moore built a proof of concept that chains these flaws with other issues to create full sessions. HPE, Supermicro, and legacy Intel products are affected.
- Predictable session IDs: Tokens generated from counters or clocks can allow attackers to take over live BMC or browser-based KVM sessions. The two most significant examples are in Supermicro systems.
- Pre-authentication memory corruption: HPE iLO management SSH services contain a length-validation error reachable before login that can be used to execute code.
- Weak firmware and configuration integrity: Supermicro, H3C, and Dell systems may allow an authenticated administrator to install a persistent implant or replace the key used to verify firmware.
- Recoverable secrets: Keys and constants extracted from public firmware can become live credentials or decrypt BMC traffic. Moore identified this issue in Supermicro, OpenBMC, Huawei, and Dell products.
- Weak default credentials: HPE, Supermicro, and Dell devices can expose password hashes through CVE-2013-4786. Default credentials are often left unchanged, while factory-randomized passwords may have small enough keyspaces for offline recovery. HPE’s defaults are eight digits or alphanumeric characters; Supermicro and Dell use somewhat longer values, potentially extending recovery from hours to days.
Many of the flaws require authentication, but Moore said attackers can often obtain the necessary access through a smaller set of pre-authentication vulnerabilities. An attacker with limited BMC access may also install an old, unpatched, or malicious firmware image, then use control of the host operating system to alter the BMC further.
Persistent compromise can survive server reinstallation
The risk is not theoretical. In 2021, researchers found ILObleed, an implant that infected HPE servers with wiper firmware. It destroyed data on hard drives and survived operating-system reinstallation, drive replacement, and other conventional cleanup measures.
The vulnerability used in that campaign had been patched in HPE BMCs four years earlier, but the compromised systems had not received the update. Last year, the Cybersecurity and Infrastructure Security Agency added a critical vulnerability in an AMI BMC to its list of known exploited vulnerabilities.
The persistence problem makes BMCs more consequential than an ordinary unpatched service. Rebuilding the operating system or replacing storage does not necessarily remove an implant living in the separate management controller.
OOBscan offers a way to check server fleets
Moore has released OOBscan, an open-source tool that administrators can use to scan their server fleets for the growing set of BMC vulnerabilities he has cataloged. The research does not say how many organizations have already been compromised, and the vendors affected by the newly discovered issues had not yet received the full technical details publicly.
Ars Technica reports that administrators can reduce exposure by taking several concrete steps:
- Use long, unique usernames and long, complex passwords.
- Disable IPMI wherever possible.
- Disable KCS, which blocks host-side access to the BMC, wherever possible.
- Isolate each BMC network interface rather than placing multiple controllers on a shared VLAN.
The scale of the scans and the continued presence of a 2013 authentication flaw point to a systemic maintenance problem, not a single defective product. BMCs were designed to keep servers manageable during outages; without strict isolation and patching, that same always-on access can give attackers a durable path into enterprise infrastructure.