Thousands of Servers Can Be Backdoored via Buggy BMCs

BMC vulnerabilities expose thousands of servers to backdoor attacks

BMC vulnerabilities are back with a vengeance. Researchers revealed Wednesday at Black Hat that thousands of Internet-connected servers from the world’s biggest manufacturers can be remotely backdoored by exploiting critical flaws, some more than a decade old, hiding deep inside system motherboards.

Baseboard management controllers, or BMCs, are miniature computers embedded into virtually every enterprise server. They run their own operating system firmware, network stack, and IP address. Administrators rely on them to monitor physical status across large fleets and handle tasks like rebooting machines, installing updates, or reinstalling operating systems. BMCs provide “lights out” and “out-of-band” management because they work even when servers are powered off or unresponsive.

The attack surface nobody watches

Security researchers have flagged BMCs since at least 2013 as a golden opportunity for hackers seeking deep, persistent datacenter access, and they've never stopped warning about it since. The chief culprit was IPMI, the protocol allowing BMCs to operate independently of servers. It's a backdoor that doesn't need the host OS. Vulnerabilities in this firmware made it possible to remotely execute malicious code on controllers and, from there, infect the servers they manage, so the threat isn't just theoretical; it's a live wire that's been exposed for over a decade. But the fix has been slow.

Little has changed. HD Moore, firmware security expert and CEO of runZero, uncovered more than a dozen new BMC vulnerabilities in products from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell, and others. Some weaknesses he warned about in 2013 remain active despite attempted fixes.

“The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize,” Moore wrote in an email ahead of his talk.

86,000 exposed devices, most of them broken

Moore oversaw two large-scale scans to quantify the threat. One probed Internet-connected BMCs broadly, while the other surveyed devices inside corporate networks, a dual approach that cast a wide net across both public and private infrastructure. The external scan found more than 86,000 BMCs exposing a management service publicly. Over 54 percent contained one or more critical vulnerabilities. That's alarming. But here's the kicker: that's just the ones we could see from outside, and the internal scan likely revealed even more exposure behind firewalls. So the real number could be far higher.

75,000 people were still exposed. That's the fallout from CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that lets attackers crack administrator-level BMC passwords offline, and it's a serious problem for anyone relying on that hardware. But the internal scan of 126,761 BMCs told a stark story, revealing that nearly 29 percent carried critical vulnerabilities, so the danger wasn't just theoretical, it was widespread. Don't ignore that number.

Moore can't disclose many flaws individually. Vendors haven't patched them yet, so he's keeping the vulnerability details confidential until they do, which naturally limits what he can share publicly. But the number of new flaws has grown by the day. That makes a specific count difficult.

Seven bug classes, one ugly picture

Generally, the bug classes break down like this:

• IPMI authentication handshake flaws allowing attackers to bypass authentication requirements, gaining limited toehold. Affected: HPE iLO, Supermicro, OpenBMC, and OpenBMC-derived products from H3C and Nvidia.
• IPMI failing to enforce integrity and encryption protections in-session. “The device decides whether to authenticate and decrypt each packet from that attacker’s own header, and not from the algorithms the session negotiated, so an unsigned, unencrypted command is accepted on a secured session,” Moore said. Affected: HPE, Supermicro, Intel (legacy).
• Predictable session identifiers generated from counters or clocks rather than secure random sources. This allows session takeover across IPMI and browser-based KVM consoles. The two worst bugs both affect Supermicro.
• Pre-authentication memory corruptions in management SSH services, reachable before authentication and drivable to execute code. Found in HPE iLO systems.
• Unsigned or attacker-controllable firmware enabling persistent implants. Affected: Supermicro, H3C, Dell.
• Secrets recoverable from public firmware used as live credentials. Affected: Supermicro, OpenBMC, Huawei, Dell.
• Default and factory-random credentials compromised via CVE-2013-4786 hash disclosure. HPE was worst with eight digits or alphanum; Supermicro and Dell use slightly longer defaults.

Many vulnerabilities require authentication, but that condition can generally be met by exploiting a smaller number of pre-authentication flaws. So don't assume that login walls stop anything. In other cases, limited BMC access lets hackers install old, unpatched, or backdoored firmware images, and that's a serious gap because once the firmware is swapped, the system's entire trust chain is broken and it's nearly impossible to detect the intrusion without specialized hardware.

This isn’t hypothetical

Exploiting BMC vulnerabilities is real. In 2021, researchers found ILObleed, a malicious implant infecting HPE servers with wiper firmware that destroyed hard drive data. Even after admins reinstalled operating systems or swapped drives, ILObleed remained intact and reactivated disk-wiping attacks. The exploited vulnerability had been patched four years earlier but wasn’t installed on compromised devices.

Last year, CISA added a critical AMI BMC vulnerability to its known exploited vulnerabilities list.

Moore released OOBscan, an open source tool that lets administrators scan entire server fleets for the growing list of BMC vulnerabilities he’s cataloged. It’s free. But that’s just the first step. Beyond running OOBscan, you’ve got to set long, unique usernames and complex passwords, disable IPMI and KCS wherever possible, and isolate each BMC NIC individually rather than stacking multiple on a shared VLAN, because a single compromise there can ripple across everything. Don't skip the NIC isolation. It matters.

“BMCs are still an underrated risk,” Moore wrote. “This work points to the ecosystem being well behind the curve in terms of code quality and architecture.”