22-Year-Old IPMI Security Flaw Exposes Thousands of Servers to Offline Password Cracking

A decades-old vulnerability in the Intelligent Platform Management Interface (IPMI) protocol is exposing thousands of internet-connected servers to potential password attacks, according to new research from cybersecurity firm Lava.

Researchers discovered 36,872 publicly accessible Baseboard Management Controller (BMC) interfaces running IPMI. Among them, 24,650 systems were found to leak password-derived authentication data without requiring successful login attempts, allowing attackers to perform offline password cracking.

BMC Interfaces Provide Powerful Server Control

Baseboard Management Controllers are dedicated management chips built into server motherboards. They allow administrators to remotely manage systems even when the operating system is unavailable or the server is powered off.

Through BMC access, administrators can:

• Restart or shut down servers remotely
• Access remote consoles
• Install operating systems
• Update firmware
• Monitor hardware components

However, exposed BMC interfaces can become a major security risk. Attackers who obtain valid credentials may gain deep control over physical servers, bypassing many traditional endpoint security protections.

Old IPMI Protocol Weakness Enables Offline Cracking

The exposure is linked to CVE-2013-4786, a weakness in the authentication mechanism of IPMI 2.0, a protocol introduced in 2004 and widely deployed in enterprise server environments.

The vulnerability allows attackers to request authentication responses from vulnerable BMC systems. These responses do not directly reveal passwords, but they contain enough cryptographic information for attackers to test password guesses offline.

Unlike traditional login attacks, offline cracking allows attackers to perform unlimited password attempts without repeatedly interacting with the target server, making weak credentials significantly easier to compromise.

Weak and Predictable Passwords Put Systems at Risk

Lava researchers found that many exposed systems relied on weak, default, or predictable passwords.

During testing, researchers identified:

• 6,240 BMC controllers that responded with authentication data linked to weak password conditions, including empty usernames.
• 2,340 systems using accounts such as ADMIN or root with passwords found in common password dictionaries.

Many of these passwords could be recovered within minutes using standard password-cracking tools.

Factory-generated credentials were also vulnerable. Some server manufacturers use predictable password formats, such as fixed-length uppercase letters or combinations of letters and numbers printed on hardware labels. Because attackers know these patterns, they can dramatically reduce the number of possible combinations they need to test.

Researchers successfully recovered factory-format passwords from two modern Supermicro servers belonging to a GPU provider during authorized testing. They did not access or modify the systems, and the affected provider removed the exposure after being notified.

Lava also reproduced the attack against an HPE server in a controlled laboratory environment. Researchers estimated that more than 30% of leaked authentication responses were linked to passwords recoverable through common wordlists or predictable factory formats.

No Universal Patch Exists for the Protocol-Level Issue

Cybersecurity experts noted that securing BMC environments remains challenging because these controllers are integrated directly into server hardware, firmware processes differ between vendors, and maintenance operations can affect remote management availability.

The issue originates from the IPMI 2.0 authentication design itself, meaning there is no single update that completely resolves the problem across all affected implementations.

Organizations Urged to Remove Public IPMI Exposure

Security researchers recommend organizations immediately reduce exposure by:

• Blocking public internet access to UDP port 623 used by IPMI
• Moving BMC interfaces to private management networks
• Allowing access only through VPNs, bastion hosts, or trusted administrative systems
• Replacing factory-default passwords
• Disabling anonymous accounts and insecure IPMI settings
• Applying available firmware updates from vendors
• Monitoring management networks separately from regular server traffic

Because the vulnerability exists within the IPMI 2.0 authentication protocol, organizations may need to disable IPMI over LAN entirely or restrict access rather than relying only on firmware patches.

The research highlights the continued risks of leaving legacy infrastructure exposed online, especially systems that provide direct hardware-level control.