Affected Systems

Over 24,000 internet-exposed Baseboard Management Controllers (BMCs) using IPMI 2.0 protocol (introduced 2004). Primarily affects Supermicro and HPE iLO 4 systems. 36,872 hosts found on UDP port 623, with 24,650 leaking authentication material. 39% of vulnerable servers located in United States.

Exploitation Status

Active exploitation observed. Researchers found ransomware note (0.3 BTC demand) on exposed HPE iLO 4 instance. CVE-2013-4786 allows attackers to capture authentication responses during IPMI handshake for offline password cracking. 6,240 hosts accept empty usernames; 2,340 use weak dictionary passwords. Supermicro default 10-character uppercase passwords and HPE factory passwords crackable in ~1 day on consumer hardware (Apple M3).

Business Impact

Compromised BMC grants attackers physical-layer control: power cycling, firmware manipulation, virtual media mounting, and pivot access to broader management plane. In virtualized/AI environments with poor segmentation, single BMC compromise can affect multiple tenants. Attacks occur below OS level, evading traditional security monitoring. Recovered credentials often reused across multiple management interfaces in same environment.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately scan for internet-exposed IPMI services on UDP port 623 and remove public access; isolate BMCs to dedicated management VLANs
  • Rotate all factory default BMC passwords on Supermicro (ADMIN + 10-char uppercase) and HPE iLO systems to complex, unique credentials
  • Disable legacy IPMI 2.0 authentication where possible; migrate to Redfish or other modern management protocols with stronger authentication
  • Audit BMC access logs for unauthorized authentication attempts or successful logins from unexpected sources
  • Implement network segmentation to prevent BMC compromise from pivoting to production workloads or multi-tenant environments