BMC vulnerabilities leave thousands of servers exposed to takeover risks

New research on BMC vulnerabilities affecting servers found more than a dozen flaws in remote management controllers sold by major hardware makers, according to Ars Technica. The findings matter because a compromised controller can give an intruder control below the server operating system, including access that may persist through ordinary recovery steps.

HD Moore, founder and chief executive of security firm runZero, presented the research at the Black Hat conference in Las Vegas, Ars Technica reported. The newly identified issues affect products sold by HPE, Supermicro, Avocent, Huawei, Lenovo, Dell and others, though detailed technical information is being held back while manufacturers have time to issue fixes.

What are BMC vulnerabilities and why do they affect servers?

A baseboard management controller, or BMC, is a separate computer built into an enterprise server's motherboard. It has its own firmware, networking and address, and lets administrators check hardware health, restart systems, install updates and reinstall operating systems even when the main server is powered down or its operating system has failed, Ars Technica reported.

That independence makes the controller a powerful target. Dark Reading reported that BMCs can provide remote console access, power controls, virtual media, firmware management and low-level configuration while operating outside the server's operating system, kernel and workloads, where many security tools focus their monitoring.

Moore's reported bug categories include weaknesses in IPMI authentication, failures to enforce session encryption or integrity protections, predictable session identifiers, memory-corruption flaws reachable before login, and controls that can allow altered firmware or configuration. Other issues involve credentials or cryptographic material recoverable from public firmware, as well as weak default or factory-generated passwords, according to Ars Technica.

What did the scans find?

In an external scan, Moore found more than 86,000 BMCs exposing a management service to the public internet. More than 54% had at least one critical vulnerability, Ars Technica reported. A separate internal scan of 126,761 controllers found that nearly 29% had one or more critical issues.

Ars Technica said up to 75,000 of the internet-exposed devices remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication process that can enable offline cracking of administrator-level BMC passwords. An attacker can obtain password-derived material and try guesses without repeatedly sending login attempts to the controller.

Those figures should not be added to results from a separate scan by security company Lava. Dark Reading reported that Lava found 24,650 BMC endpoints returning password-derived authentication material associated with CVE-2013-4786; 6,240 accepted empty usernames with weak passwords, and 2,340 named accounts used passwords found in common wordlists. The two studies used different scans and measured different conditions.

Exposure does not prove a server was compromised

The scan results identify reachable or vulnerable controllers, not a confirmed count of breached servers. Dark Reading reported that Lava said it had evidence of exploitation in the wild, while Ars Technica described ILObleed, a 2021 malicious HPE firmware case in which the relevant flaw had been patched four years earlier but not installed on the affected machines.

Because the new flaw details and final affected-product list were not public, the reporting does not establish patch status for every model or a global total of vulnerable servers. It does show that organizations need to treat BMCs as a distinct, highly privileged management system rather than relying only on protections running inside the server operating system.

This story draws on original reporting from Ars Technica.