Summary
- Lava identified 36,872 internet-exposed IPMI services, including 24,650 that returned password-derived material.
- More than 30% of captured hashes were associated with recoverable passwords using dictionaries and factory-password patterns.
- Baseboard management controllers can provide power, firmware, console, and virtual-media access below the operating system.
Tens of thousands of server-management controllers are accessible from the public internet, including more than 24,000 systems that disclosed password-derived material before authentication, according to research examining the infrastructure beneath conventional operating systems.
Lava identified 36,872 hosts exposing Intelligent Platform Management Interface services. Of those systems, 24,650 responded in a way associated with CVE-2013-4786, a longstanding protocol weakness that allows an unauthenticated user to obtain material derived from an account password.
The researchers said more than 30% of the returned hashes were associated with passwords recoverable through dictionaries and patterns used for credentials printed on factory labels. They also found systems accepting empty usernames with weak passwords and named accounts protected by common credentials.
Lava said its researchers did not authenticate to the systems using recovered passwords. The work measured exposure and credential weakness rather than attempting to establish administrative control of the affected devices.
Baseboard management controllers, or BMCs, provide remote access to power controls, firmware, console sessions, hardware monitoring, and virtual media. They continue operating independently from the server’s main operating system and can remain available when the host is shut down or unavailable.
An administrator can use the controller to recover failed equipment without entering the datacentre. The same access can allow an intruder to restart a server, alter firmware, attach installation media, observe the boot process, or replace the operating system.
Administrative access beneath the host
Endpoint security tools running inside the operating system may have little visibility into activity carried out through the BMC. Network monitoring can detect some communications, but only where management traffic is separated, retained, and reviewed.
Public exposure may result from a deliberate remote-support arrangement, a temporary configuration left in place, hosting-provider architecture, or an interface forgotten after installation. The affected population included modern infrastructure as well as older equipment.
Factory credentials create risk even when the printed passwords appear complex. Manufacturing patterns may make groups of credentials more predictable than their length suggests, while the protocol weakness allows attackers to test the derived material offline without producing repeated failed logins on the controller.
Management interfaces should be removed from the public internet and placed on dedicated networks reached through controlled administrative paths. Multifactor authentication should be enabled where the controller supports it, although it cannot correct a protocol that leaks password material before the normal login process.
Factory passwords and shared credentials should be replaced, and organisations should determine whether the same account is used across racks, sites, suppliers, or customers. Reuse can turn one recovered credential into access across a large hardware estate.
Firmware versions and protocol settings also require review. Legacy cipher modes may need to be disabled, controller software updated, and functions such as remote media restricted to approved administrative sessions.
Monitoring should include power events, console access, firmware changes, user creation, authentication from unusual locations, and connections outside planned maintenance windows. Logs may need to be forwarded away from the controller because local records can be altered or lost after compromise.
The exposure carries additional weight as European organisations expand datacentre and GPU capacity. Rapid deployment through colocation and specialist infrastructure providers can divide responsibility for the hardware-management layer among the customer, facility operator, equipment vendor, and managed-service provider.
Contracts and asset inventories should identify which party configures the BMC, holds administrative credentials, applies firmware, monitors access, and responds to compromise. A server may be physically protected inside a secure facility while its lowest management layer remains reachable from the public internet.
