InfoSecBulletin Cybersecurity for mankind
Thousands of data centers are in danger because of a 22-year-old problem in Baseboard Management Controller (BMC) processors, says the security company Lava. BMCs are found in many server platforms. They allow server management even if the operating system is not working. They are usually very important control points in a data center.
Administrators can use a BMC to restart the host, update firmware, change basic platform settings, check hardware sensors, and more. They can do this through different management methods, such as the IPMI protocol, the Redfish API, and a web admin interface.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
“In many implementations, these interfaces share the same user database. A credential that works for IPMI may also work for the web interface or Redfish API. This matters because the IPMI authentication process can expose information that enables offline password recovery,” Lava notes.
Nearly 37,000 server-management interfaces are exposed on the internet and use the IPMI protocol, according to the cybersecurity company. More than 24,000 of these show password-based authentication hashes before login.
The core issue is CVE-2013-4786, a vulnerability introduced in 2004 in the IPMI 2.0 authentication protocol that allows attackers to obtain password hashes and crack them offline by “obtaining the HMAC from a RAKP message 2 response from a BMC,” a NIST advisory reads.
“During authentication, the BMC can return an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester. An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline,” Lava explains.
Attackers could use the security flaw to find weak, reused, or default passwords without needing to send a new request for each password. This is easier than making many login attempts online.
Lava found that 6,240 hosts let users sign in with no username and a weak password. Also, 2,340 of these had accounts like Admin or root that used passwords from well-known lists.
Some BMCs were using usual passwords and simple factory-set password types, as said by the cybersecurity company.
“This vulnerability exposes a broader security gap in the data center management plane. BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage. Combined with modern GPU cracking and predictable factory passwords, this vulnerability can turn a single exposed BMC into a privileged and difficult-to-detect foothold across the management network,” Lava notes.
