The ‘no man’s land’ beneath the OS on enterprise servers is becoming the malicious actors’ next target.
Attackers are gaining a foothold into broader data center environments by exploiting Baseboard Management Controllers (BMCs) that are largely unprotected, still running decades-old protocols and susceptible to a vulnerability published 13 years ago, according to data center security company Lava.
Lava’s red team researchers were able to hack into BMCs, which provide out-of-band remote control over servers without the need for physical access, within minutes by guessing basic passwords. BMCs on Supermicro and HPE servers were among the most impacted.
“BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage,” Michael Katchinskiy, Lava’s head of security research, explained in a blog post. “Most security tools monitor the operating system, kernel, containers, and workloads.”
But BMCs operate outside that trust boundary, he said, “giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.”
How attackers can exploit BMC weaknesses
As the name ‘baseboard’ would imply, BMCs are specialized micro-controllers embedded in server platforms that operate independently of the host system’s main CPU, memory, and operating system (OS). This gives admins the ability to do out-of-band management and troubleshooting of servers, update firmware, change configurations, and read hardware sensors, among other actions.
“In practice, the BMC is one of the most privileged control points in a data center,” Katchinskiy noted.
But BMCs can expose management planes such as the 22-year-old out-of-band IPMI, the newer HTTPS-based Redfish, browser-based admin interfaces, and remote console features. In many cases, these share the same database and even the same credentials.
The culprit enabling the current attacks is a vulnerability in the IPMI 2.0 authentication protocol, tracked as CVE-2013-4786, that was published in 2013.
Lava’s researchers discovered 36,872 BMCs reachable from the public internet still exposing IPMI. Of those, 66% (24,650) disclosed authentication hashes, scrambled versions of passwords that are stored and later used to authenticate users. Hackers can take them offline to examine and recover original passwords.
The researchers tested hashes against common wordlists and found that more than 30% of the hashes were linked to “reused, factory-set, or predictably formatted” passwords. These matches were discovered in minutes, and often during the first pass. And nearly 17% of BMCs accepted an empty username field with a weak password.
Interestingly, Supermicro, which is in wide use across data centers, GPU infrastructures, and hosted environments, accounted for more than half of responding BMCs, but their credentials did not match passwords in the researchers’ wordlist.
This was “expected,” the researchers note, because in 2019 Supermicro replaced a shared admin password on impacted products with unique, factory-issued passwords which consisted of 10 uppercase letters printed on a chassis label.
The researchers reported their findings to impacted parties and to Supermicro, which said it would review potential improvements to its default password policy for future hardware revisions. Lava said that Supermicro has since fixed the exposure.
Lava has also created an interactive map of the internet-exposed BMCs it uncovered.
Why this attack method is dangerous
BMCs sit a layer below that which many security products monitor, on shared out-of-band management networks where administrative credentials are often reused. Thus, malicious changes made to BMCs or other platform hardware are able to survive OS reinstalls, disk replacements, and standard incident response procedures, Katchinskiy noted.
The risk is “especially pronounced” in neocloud and GPU cloud environments, he said. AI infrastructure can span thousands of GPUs on shared management networks, with joint storage, high-speed interconnects, and multi-tenant tooling.
He pointed out that, while a customer may rent their own dedicated servers, they are still connected to shared, provider-managed, out-of-band networks where orchestration and provisioning services, credential stores, and admin tools span infrastructure used by numerous joint customers.
That means, he noted, that the risk extends well beyond a single server, and attackers can gain a foothold to reach larger portions of data center infrastructure.
In the environments examined, BMC management networks “lacked effective segmentation, access controls, and monitoring,” Katchinskiy said. “A single compromised BMC can therefore become a path to additional servers, critical infrastructure, and customer workloads.”
Why BMCs are so often overlooked
There are “countless examples” of hardware and software tools that don’t get patched because IT or security teams determine that, while they are vulnerable, threat actors can’t exploit them, noted David Shipley of Beauceron Security. For instance, there’s a commonly-held notion that if a server or piece of software is air-gapped, meaning it is not network connected or not connected to the internet, it is safe.
“If it’s overlooked, it’s likely because it sits in this weird in-between space between teams,” he said. It’s not really part of networking, and it exists before the OS is booted, so it’s not under the domain of the system administrators.
Thus, getting access is “so simple,” Shipley noted, and attackers can do “all kinds of not fun things in theory.”
For instance, they can power off devices, which can shut down a company’s servers. Second, they could potentially take control of a server by “reimaging it and having their own OS in play,” although that should be detected pretty quickly, he pointed out. Third, they can be persistent.
“It gives them a place to live on a network and think about finding other holes to exploit as vulnerabilities,” said Shipley.
A ‘simple fix’
There’s a “simple” fix to this problem, according to Katchinskiy: IPMI and Redfish should never be exposed to the public internet.
To keep attackers out of BMCs, defenders should:
Replace factory-issued passwords.
Restrict BMC access to a dedicated private management network, VPN, or other controlled path.
Apply network access controls so that only approved admins can reach BMC interfaces.
Disable “legacy or weak” options like IPMI 1.5, anonymous accounts, or, worse, authentication that grants access or tokens without requesting a password, secret, or login.
Monitor management networks and production workloads separately.
And, Katchinskiy emphasized, “organizations must treat management layers as critical security boundaries: Isolate them, remove public exposure, rotate factory credentials, and monitor them continuously.”
No Responses