24,650 Exposed BMCs Reveal IPMI Password Hashes

Cybersecurity researchers have reported that more than 36,000 Baseboard Management Controller (BMC) management interfaces expose the Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 Internet‑exposed server‑management interfaces running IPMI, 24,650 were discovered to disclose password‑derived authentication hashes before login ¹.

The BMC is a dedicated microcontroller on many servers that provides out‑of‑band management functions such as power cycling, firmware updates, and hardware monitoring. The IPMI interface allows administrators to log in remotely without using the operating system’s network stack, making it attractive for legitimate remote support but also a high‑value target for attackers. When exposed publicly, an attacker can attempt brute‑force or dictionary attacks against the hash values returned by the device.

These disclosed hashes are derived via PBKDF2 (Password Based Key Derivation Function), which applies multiple rounds of hashing with a salt. Even though salted, PBKDF2 still permits offline rainbow table lookups; once the hash is captured, an adversary can try candidate passwords faster than expected, especially if weak or reused credentials are used. This mirrors earlier database breaches where stolen keys were employed to sign malicious code, demonstrating how vulnerabilities at lower levels can compromise entire infrastructure tiers because they provide access points beyond just user accounts.

Baseboard Management Controllers are often overlooked—they’re essential for remote server management but frequently have weak passwords that aren’t rotated regularly. These password hashes use PBKDF2, meaning even with salted hashing an attacker could try rainbow table lookups offline to crack them faster than expected. This is reminiscent of early database breaches like RSA back in ’17 when stolen keys were used to sign malicious code – it shows how vulnerabilities at lower levels can compromise entire infrastructure tiers because they provide access points beyond just user accounts.

Given the sheer volume—nearly two‑thirds of exposed interfaces—and the ease with which these pre‑login hashes can be leveraged, attackers now possess a low‑effort vector to gain privileged remote control over thousands of servers worldwide. The implications extend beyond simple credential theft: compromised BMCs allow full hardware reset, firmware tampering, and persistent footholds that bypass operating‑system defenses entirely.

The findings underscore the need for immediate remediation: enforce strong, unique passwords on all IPMI interfaces; enable network segmentation so only trusted administrators can reach them; consider disabling public IPMI exposure where possible; audit BMC firmware for known weaknesses and apply vendor patches promptly. Without such measures, the exposed 24,650 credentials represent a significant blind spot in today’s server security posture.