Nearly 25,000 internet-facing servers are leaking password hashes before anyone even logs in, and the flaw making it possible is old enough to vote. New research from Lava Labs shows a 2013-era weakness in IPMI, the out-of-band protocol administrators use to reach a server when its operating system is unreachable, is still exposing data centers at scale in 2026.
A blind spot below the operating system
Baseboard Management Controllers, the small embedded processors that let administrators power-cycle, reimage, and monitor a server independently of its main operating system, are meant to be reachable only from a locked-down management network. Lava Labs researcher Michael Katchinskiy scanned the open internet for exposed IPMI services on UDP port 623 and found 36,872 of them answering. Of those, 24,650, or 66.9 percent, handed back password-derived authentication material before the client ever completed a login.
The weakness traces to CVE-2013-4786, a flaw in how the RAKP (Remote Authentication Key-Exchange Protocol) handshake in IPMI 2.0 works. During authentication, the BMC returns an HMAC-SHA1 code calculated from the account password and session values the requester already knows. An attacker does not need to guess a password online, one attempt at a time, against a system that might lock them out. They capture the hash and crack it offline, at whatever speed their hardware allows.
How fast the cracking goes
According to Lava Labs, factory-default passwords on HPE iLO systems fell in about a minute using commodity GPU hardware, while Supermicro’s factory defaults took closer to an hour. The research also found 6,240 endpoints that accepted empty usernames paired with weak passwords, and 2,340 systems running named accounts such as ADMIN or root with passwords matching public wordlists. Supermicro hardware accounted for more than half of the BMCs that responded to scans, and Lava Labs says it is finding roughly 60 newly exposed IPs per day between May and July 2026, evidence the exposure is still growing rather than shrinking. More than 14,000 of the exposed hosts sit in the United States, with the remainder concentrated in Germany, China, the Netherlands, and the UK.
Why a 13-year-old flaw still works
CVE-2013-4786 has been public since the Rapid7 disclosure that documented it more than a decade ago, and Dell has told researchers directly that “this is an inherent problem with the specification for IPMI v2.0” itself, not a bug any single vendor can fix with an update. That is precisely why it persists. Security teams are used to a workflow built around patching: a CVE appears, a vendor ships a fix, the fix gets deployed, the finding closes. IPMI 2.0 breaks that workflow at the first step. There is no fix to deploy, only a protocol to avoid exposing, and avoiding exposure requires an active decision (segmenting a management network, disabling a legacy feature) rather than a passive one (applying an update). In server fleets provisioned years ago and rarely revisited, that decision was often never made, and the growth in Lava Labs’ daily scan count suggests it still is not being made consistently today.
This is not theoretical
Lava Labs found direct evidence that attackers are already working these interfaces: one exposed HPE iLO 4 login page had been defaced with a ransom note demanding 0.3 BTC, a signature left behind by whoever had already gained control of the management plane. That distinction matters for defenders. A BMC compromise does not touch the operating system at all, which means it survives a full OS reinstall and stays invisible to endpoint detection tools watching the host it manages.
What it means for the security leader
IPMI exposure sits in an unusual blind spot. It is neither a software supply-chain problem nor a conventional endpoint risk, so it tends to fall between the team that owns vulnerability management and the team that owns data center networking. Because CVE-2013-4786 is a specification-level flaw in IPMI 2.0 itself, with no vendor patch that removes it, it will not show up as a missing update in a standard patch compliance report. It has to be found and fenced off, not patched away.
This builds on a pattern CyberTech has already tracked in recent reporting on an exposed authentication bypass in Check Point’s SmartConsole management interface: the consoles built to administer security and infrastructure tooling are themselves becoming the softest target on the network. Attackers increasingly route around a hardened operating system and go straight for the interface that manages it, precisely because so few organizations monitor that layer with the same rigor.
What to do about it
Lava Labs’ recommendations are straightforward and, for most enterprises, overdue.
- Block UDP port 623 at the network perimeter so IPMI is never reachable from the open internet.
- Replace every factory-issued BMC password during provisioning, before the device touches a production network.
- Disable IPMI 1.5 and other legacy protocol options, including cipher suite 0 and anonymous accounts.
- Restrict BMC access to a dedicated, isolated management network with its own access controls and monitoring.
- Where the hardware supports it, move to Redfish over TLS rather than legacy IPMI for out-of-band management.
Detection is the other half of the fix. Security operations teams that already log flows from their perimeter firewall or cloud edge can add a standing alert for any outbound or inbound UDP/623 traffic that touches an address outside the known management VLAN; on most enterprise networks that traffic should not exist at all, which makes it an unusually clean signal rather than a noisy one. Asset inventories that track operating systems and agents but not embedded management controllers should be extended to cover BMCs explicitly, since, as this research shows, they are reachable and attractive independent of anything running on the host above them.
None of this requires a vendor patch. It requires an inventory. Security teams that cannot say with confidence how many BMCs on their network are reachable from outside the management VLAN should treat that gap as the finding, not the research paper. Given that Lava Labs is adding roughly 60 newly exposed hosts to its count every day, an internet-facing BMC found today is unlikely to be an anomaly. It is far more likely to be one of many.
Source: Lava Labs
