24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

A mass-exposure research disclosure maps the BMC problem — the leak is baked into a 2004-era handshake, so the remedy is network isolation, not a patch.

THE INTERNET — Researchers who scanned the public internet reported finding 36,872 Baseboard Management Controller (BMC) management interfaces running the Intelligent Platform Management Interface (IPMI) 2.0 protocol, and determined that 24,650 of them disclose password-derived authentication hashes to anyone who asks — before login. The Hacker News and Help Net Security reported the findings on July 28, 2026, describing an exposure that reaches modern server fleets, not just legacy hardware.

What makes the count alarming is where it sits. A BMC is a small always-on computer that lives underneath the operating system: it power-cycles the host, mounts virtual media, opens a remote console, and flashes firmware. The hashes leak as part of the IPMI 2.0 handshake, built on an authentication protocol introduced in 2004, and the exposed service listens on UDP port 623. As reported by The Hacker News and Help Net Security, this is a design characteristic of the protocol rather than a single product bug — which is why the defender response is posture, not a patch. This piece summarizes what the research documents and what remains unconfirmed, without reproducing any credential-recovery technique.

What the Research Found

According to the reporting, researchers queried the public internet for management interfaces speaking IPMI on UDP port 623 and counted 36,872 that answered. Of that population, 24,650 — roughly two in three — returned a password-derived authentication hash to an unauthenticated request, before any login had taken place. The hash is tied to a valid account on the controller, and it is handed over as an ordinary step in the IPMI 2.0 handshake.

The research was reportedly conducted by the security firm Lava, which identified the exposed hosts via internet-wide scanning; reporting attributes the count and analysis to that team. Reporting also connects the behavior to CVE-2013-4786, a long-known information-disclosure weakness in the IPMI 2.0 specification for which vendors have said there is no patch, because the disclosure is part of how the protocol is designed to work. The takeaway for defenders is the scale and the placement, not the mechanics: tens of thousands of controllers, many on current hardware, are reachable and talkative on the open internet.

The reporting indicates the exposure is not confined to aging equipment. Researchers said the exposed population included modern servers operated by compute and GPU providers, and that a meaningful share of the controllers were still using factory-issued credentials — the kind printed on a chassis sticker at the factory. The CyberSignal is not reproducing how recovered hashes map back to passwords; the defender-relevant point is that unchanged factory credentials sharply raise the stakes of any pre-login disclosure.

Why the BMC Layer Matters

A BMC sits below the operating system by design. It is the out-of-band controller administrators rely on to manage a server when the main system is off, wedged, or being rebuilt from scratch. Through it, an operator can cut or restore power to the host, attach virtual media as though inserting a disk, open a full remote console, and rewrite firmware. Those are exactly the capabilities that make remote data-center management possible without a technician standing in the aisle.

That same reach is why exposure at this layer is not equivalent to an ordinary application flaw. Reaching a BMC means reaching underneath every control the operating system enforces above it — endpoint agents, host firewalls, and OS-level logging all live on the layer the BMC can power-cycle. A management controller answering questions on the open internet is therefore a foothold with unusually deep leverage over the physical machine, which is why the exposure counts here are worth taking seriously even before anyone weaponizes them.

Why the IPMI 2.0 Handshake Exposes Hashes Pre-Auth

The disclosure is a property of the IPMI 2.0 authentication exchange, not a bug bolted on afterward. The protocol dates to 2004, and its handshake was specified in an era with different assumptions about what could safely be sent to an unauthenticated party. During that handshake, a controller returns material derived from a valid account's password before the requester has proven who they are — the leak the research counted across 24,650 hosts.

Because the behavior lives in the specification, individual vendors cannot simply issue a fix that closes it without breaking IPMI 2.0 compatibility — which is how CVE-2013-4786 has persisted for more than a decade. That reframes the defender question. There is no version number to upgrade to and no CVE to close; there is only the decision to stop letting the internet reach the port at all. As The CyberSignal has noted with other infrastructure weaknesses that outlive any single patch, a flaw with no fix on the horizon shifts the whole burden onto exposure management.

What Defenders Should Verify

The guidance here is deliberately conservative and posture-first, because the underlying disclosure cannot be patched away. Reporting and long-standing IPMI hardening advice converge on the same short list, and every item is about removing reachability and removing easy wins rather than fixing the protocol.

Block UDP port 623 at the network edge. No BMC management interface should answer IPMI queries from the public internet; the single highest-value action is ensuring the port is unreachable from outside. Then isolate BMCs onto a dedicated, access-controlled management VLAN that is physically or logically separated from production and general corporate traffic, so that reaching a controller requires first reaching that restricted network.

Apply vendor-specific IPMI hardening on top of isolation. Replace factory-default credentials on every controller during provisioning — the research reportedly found unchanged factory passwords in the exposed set — and follow the server maker's guidance for locking down the management stack. Where the platform allows it, disable legacy IPMI 1.5 support, remove weak or anonymous cipher options, and turn off any accounts that are not needed. Consult your vendor's BMC hardening documentation (for example, Supermicro, Dell iDRAC, HPE iLO, or an OpenBMC-based platform) for the exact steps, since the controls differ by OEM.

Finally, verify the assumption rather than trusting it. Scan your own external address space for anything answering on UDP 623, and treat any hit as an exposure to close. The population the researchers counted exists because these interfaces were reachable when their owners believed they were not.

Open Questions

Several specifics remain unconfirmed at publication, and The CyberSignal is not filling them in. Reporting attributes the scan to the security firm Lava, but the full methodology, the precise scan date, and any independent replication are still settling. A geographic and vendor breakdown has been reported in part — a large share of exposed hosts sits in the United States, and modern Supermicro and HPE systems appear among the affected — but a complete OEM-by-OEM census is not established in the material reviewed.

It is also not confirmed whether any of the identified organizations were notified, whether they have since restricted access, or which specific mitigation framework the researchers formally recommend. What is not in doubt is the shape of the problem: a large, internet-reachable population of controllers disclosing authentication material before login, on a protocol with no patch coming. As provider statements, notification details, and independent scans emerge, the picture will sharpen.

The CyberSignal Analysis

The reported facts above come from the disclosure and its reporting; what follows is The CyberSignal's editorial reading. None of the judgments below are new reported facts.

Signal 01 — The Fix Is Exposure Management, Not a Patch

The instinct with any disclosure is to ask which update closes it, and this one frustrates that instinct by design. Our reading is that the story is architectural: the leak lives in a 2004-era protocol specification, which is why a decade-old CVE still has no patch. The load-bearing detail for defenders is that the only lever is reachability — whether the internet can touch UDP 623 at all.

That shifts effort from patch-hunting to boundary-mapping. Knowing where your BMCs live, and confirming none of them answer from the public internet, pays off regardless of whether anyone ever targets this specific disclosure. Exposure you have mapped is exposure you can close.

Signal 02 — Depth of Access Is the Real Multiplier

Two in three exposed controllers leaking a hash would matter less if the BMC were a peripheral. It is not. Our assessment is that the severity comes from placement: a controller that can power-cycle the host, mount virtual media, and flash firmware sits beneath every OS-level defense an organization has invested in. Exposure at that layer bypasses the layer above it by definition.

The practical consequence is to weight BMC hygiene higher than its low profile suggests. These interfaces are easy to forget precisely because they work quietly in the background — which is exactly why an unmanaged one is a disproportionate liability.

Signal 03 — Factory Defaults Turn a Leak Into a Liability

A pre-login disclosure is a concern; a pre-login disclosure against an unchanged factory password is a far larger one. Our view is that the reported presence of factory-issued credentials in the exposed set is the detail defenders can act on most directly, because it is the one entirely within their control. The protocol cannot be patched, but a default password can be changed.

We would treat provisioning as the checkpoint. Every controller that reaches production with its shipped credentials intact is a standing invitation; making credential replacement a non-negotiable step in the build process removes the easiest win an outside party could hope for, even on a protocol that will keep talking.

Sources