InfoSecBulletin Cybersecurity for mankind
Thousands of data centers are in danger because of a 22-year-old problem in Baseboard Management Controller (BMC) processors, says the security company Lava. BMCs are found in many server platforms. They allow server management even if the operating system is not working. They are usually very important control points in a data center.
Administrators can use a BMC to restart the host, update firmware, change basic platform settings, check hardware sensors, and more. They can do this through different management methods, such as the IPMI protocol, the Redfish API, and a web admin interface.
Thousands of data centers are at risk of compromise due to a 22-year-old flaw
Bangladesh Launches (CIRS) and National ICT & Cyber Security Rating System (NRS)
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
“In many implementations, these interfaces share the same user database. A credential that works for IPMI may also work for the web interface or Redfish API. This matters because the IPMI authentication process can expose information that enables offline password recovery,” Lava notes.
Nearly 37,000 server-management interfaces are exposed on the internet and use the IPMI protocol, according to the cybersecurity company. More than 24,000 of these show password-based authentication hashes before login.
The core issue is CVE-2013-4786, a vulnerability introduced in 2004 in the IPMI 2.0 authentication protocol that allows attackers to obtain password hashes and crack them offline by “obtaining the HMAC from a RAKP message 2 response from a BMC,” a NIST advisory reads.
“During authentication, the BMC can return an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester. An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline,” Lava explains.
Attackers could use the security flaw to find weak, reused, or default passwords without needing to send a new request for each password. This is easier than making many login attempts online.
Lava found that 6,240 hosts let users sign in with no username and a weak password. Also, 2,340 of these had accounts like Admin or root that used passwords from well-known lists.
Some BMCs were using usual passwords and simple factory-set password types, as said by the cybersecurity company.
“This vulnerability exposes a broader security gap in the data center management plane. BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage. Combined with modern GPU cracking and predictable factory passwords, this vulnerability can turn a single exposed BMC into a privileged and difficult-to-detect foothold across the management network,” Lava notes.
