The baseboard management controllers powering servers worldwide — even those from top manufacturers — are a security nightmare

At the heart of the issue are baseboard management controllers (BMCs), tiny computers built into nearly every enterprise server's motherboard. These microcontrollers operate independently, each running its own firmware, network stack, and IP address. IT teams use BMCs to keep tabs on server hardware across large fleets and to handle tasks like restarting machines, pushing updates, or wiping and reinstalling operating systems. Because BMCs function even when the host server is powered down or frozen, they enable what's called "out-of-band" or "lights-out" management

Security researchers have been sounding the alarm about BMCs since at least 2013, warning that they offer attackers a prime target for achieving deep, long-term footholds in datacenters. IPMI—the protocol enabling BMCs to run independently and handle admin functions—was identified as the main weak point. Bugs in this firmware allowed hackers to remotely run malicious code on the controllers, using that access as a launchpad to compromise the servers themselves.

New findings unveiled Wednesday at the Black Hat security conference in Las Vegas reveal that not much has improved since then. HD Moore, a firmware security specialist who founded and leads the security company runZero, identified over a dozen fresh vulnerabilities affecting BMCs from vendors including HPE, Supermicro, Avocent, Huawei, Lenovo, and Dell. He also discovered that several of the flaws he flagged back in 2013 are still exploitable today, even after fixes were supposedly put in place.

The Vulnerability List Keeps Getting Longer

Moore described the situation in a pre-talk email as leaving behind a widespread, poorly monitored, and poorly patched secondary attack surface — one that's both exposed to the internet and common within corporate networks, and far easier to exploit than most people assume.

To back this up with data, Moore ran two large-scale scans. One targeted internet-facing BMCs broadly, while the other looked at devices sitting inside corporate networks. The external scan turned up over 86,000 BMCs with a publicly exposed management service, and more than 54 percent of those had at least one critical vulnerability. Roughly 75,000 of them were still susceptible to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that lets attackers crack administrator-level BMC passwords offline. The internal scan, covering 126,761 BMCs, found that close to 29 percent carried at least one critical vulnerability.

Missing integrity and encryption checks mid-session. According to Moore, the device determines whether to authenticate and decrypt incoming packets based on headers the attacker controls, rather than the encryption method actually agreed upon for that session — meaning a plain, unsigned command can slip through on a supposedly secure connection. Moore built a proof-of-concept that strings together several individually low-risk bugs like this into a complete working exploit. HPE, Supermicro, and older Intel systems are affected.

Guessable session tokens. Rather than using cryptographically secure randomness, session IDs are built from simple counters or timestamps, making it possible for an attacker to guess and hijack another user's active BMC session—whether through the IPMI service or the browser-based KVM interface. The two worst examples of this both turned up in Supermicro hardware.

Memory corruption bugs reachable without logging in. A flaw in how the SSH management service checks input length can be triggered before authentication and used to run arbitrary code. Moore found this class of bug in HPE's iLO controllers.

Firmware that isn't signed or can be tampered with, plus weak configuration safeguards. Once logged in as an admin, an attacker can plant a lasting implant or swap out the key used to validate firmware authenticity. These issues can be combined with separate bugs that bypass login or escalate privileges. Supermicro, H3C, and Dell are among the vendors affected.

Hardcoded secrets pulled straight from firmware. Encryption keys and other constants embedded in publicly available firmware images can be extracted and reused to log into BMCs or decrypt their traffic. This affects Supermicro, OpenBMC, Huawei, and Dell devices.

Weak or default passwords, exploitable via CVE-2013-4786's hash leak. Many devices still ship with unchanged default logins. Even where passwords are randomized at the factory, the limited number of possible combinations means they can often be cracked offline. HPE, Supermicro, and Dell are affected — HPE fared worst with eight-character alphanumeric defaults, while Supermicro and Dell use somewhat longer ones that make cracking slower and costlier, though not impossible.

Although many of these bugs require the attacker to already be logged in, that hurdle is often cleared by first exploiting one of a smaller set of pre-authentication flaws Moore uncovered. In other scenarios, an attacker with even limited BMC access can push an outdated, unpatched, or maliciously modified firmware image onto the device — then leverage that foothold to further compromise the BMC through the operating system.

This isn't just theoretical. Back in 2021, security researchers found ILOBleed, a piece of malware that planted destructive wiper firmware on HPE servers, permanently erasing data on connected drives. Disturbingly, the implant survived typical cleanup efforts — reinstalling the OS, swapping hard drives — and would simply reactivate the wiping routine each time. Ironically, HPE had actually patched the underlying vulnerability four years before the attacks, but the fix simply hadn't been applied to the affected machines.

Just last year, CISA flagged a serious AMI BMC vulnerability and added it to its catalog of known exploited vulnerabilities.

To help organizations get ahead of the problem, Moore built and released a free, open source scanning tool called OOBscan, letting admins check their entire server inventory against the growing catalog of BMC flaws he's documented. Beyond running the scanner, he recommends several defensive steps:

As Moore put it, BMCs remain a threat that doesn't get enough attention — and his findings suggest the entire ecosystem is lagging significantly behind when it comes to solid code and sound architecture.