IPMI Flaw Leaks Password Hashes From 24,650 Exposed Servers

A flaw more than 20 years old just left 36,872 servers reachable straight from the internet. Not the websites they run, the servers themselves, through the one small chip that controls them even when they are powered down. Of those, 24,650 handed over what an attacker needs to crack their password, before a single person had logged in, and there is no patch on the way. 🧐

Server-class machines carry a second, smaller computer built onto the motherboard. It has its own processor, its own network port, and its own power, and it runs whether the server is switched on or off. Its job is to let an administrator manage the machine from far away: power it on, reboot it, reinstall it, watch the screen, all without walking into the data center. Different brands give it different names, iLO, iDRAC, or just the IPMI interface, but underneath it is the same part, a baseboard management controller, a BMC.

Whoever controls that chip controls the server itself. You can power it up, take over the screen and keyboard as if you were standing in front of it, mount your own disk image and boot from it, and rewrite the firmware. It sits below the operating system, so antivirus running inside that operating system never sees it. Reinstall the OS, swap the hard drive, and the chip is still sitting there with whatever you left behind on it.

So the question researchers asked was a plain one. How many of these chips are sitting open on the public internet, and how hard are they to get into.

The answer, from a scan on the 6th of May: 36,872 of them, reachable straight from the open web. The United States held the most by far, more than 14,000. The Netherlands sat fourth on the list, with just over 2,000.

Then it got worse. Of those, 24,650, two out of three, gave up the scrambled form of a password on request. More than 30 percent of those traced straight back to weak or factory-pattern passwords. On 6,240 of them a blank username with a weak password was enough to get a response. On another 2,340 a named account like ADMIN or root sat behind a password straight out of a public wordlist. These are not forgotten boxes in a closet. They are the machines running businesses, universities, telecom networks, and the data centers behind the current rush into AI.

Here is how the password comes out. When you try to log in to one of these chips over the network, the protocol has it send back a piece of data calculated from the account password. It sends that back before it has checked whether you belong there at all. The idea was that both sides prove they know the password. The catch is that the chip answers first, before you have proven anything.

Pulling that data takes one tool that has shipped with Metasploit for years:

1
2
3

msf6 > use auxiliary/scanner/ipmi/ipmi_dumphashes
msf6 > set RHOSTS 203.0.113.10
msf6 > run

The chip answers with a hash, and the module writes it out in a format a cracker can read. From there the guessing happens offline, on your own machine, as fast as the hardware allows. The account never locks, nothing counts the failed tries, and the chip has no idea it is happening. That same first message also tells you whether an account name exists, so an attacker can map out the valid logins before touching a single password.

Cracking it is one more command. Mode 7300 is the setting for this exact hash:

1

hashcat -m 7300 ipmi_hashes.txt rockyou.txt

Point it at a list of common passwords and the weak ones fall in seconds.

This is CVE-2013-4786. The number says 2013, the year it was filed, but the weakness lives in the IPMI 2.0 specification from 2004. It is not one company’s mistake in one product. It is baked into the standard that vendors built to. That is also why there is no patch. One vendor said it plainly in its own advisory: this is an inherent problem with the specification, and it cannot be fixed, only walled off.

For some of these chips you do not have to crack anything at all. There is a setting called cipher zero, meant as a fallback, that tells the chip to accept any password you send, including an empty one. Where it is left on, you skip the hash and the cracking and walk straight in, then hand yourself a fresh admin account:

1

ipmitool -I lanplus -H 203.0.113.10 -C 0 -U Admin -P '' user list

If that returns the user list, the lock is not just weak, it is missing.

Now the part that turns this from an old story into a new one.

More than half the chips researchers found came from a single maker, Supermicro. And that maker had done something right. Back in 2019 they stopped shipping boards with the same ADMIN / ADMIN login, the factory default printed in the manual. A California law, SB-327, had made shared default passwords illegal for internet-connected devices. So each board started leaving the factory with its own unique password, printed on a sticker.

Here is where it falls apart. That unique password is exactly ten uppercase letters, A to Z, and nothing else. Always ten, always letters. Which means an attacker knows the exact shape of those passwords before guessing a single character. You do not guess blindly, you tell the cracker the exact shape and let it fill in the rest:

1

hashcat -m 7300 ipmi_hashes.txt -a 3 ?u?u?u?u?u?u?u?u?u?u

Each ?u stands for one uppercase letter. Twenty-six letters across ten positions comes to about 141 trillion combinations, and not one possibility sits outside that set. On a machine with eight graphics cards, working through all 141 trillion takes roughly an hour. The other big brand’s factory format is eight characters, and that one falls in seconds.

The fix that was meant to protect these servers is the thing that made them crackable. Unique is not the same as strong. A unique password that always follows the same short, published pattern still leaves a fixed, countable number of possibilities, and the attacker has the time to try them all. Told about it, the maker agreed the risk was genuine and said it would look at longer passwords for future hardware.

This is not sitting in a lab as a what-if. While scanning, researchers opened one exposed server’s login page and found a ransom note where the normal screen should have been. The data was encrypted, it said, and the price to get it back was 0.3 bitcoin, with a throwaway email address to make contact. Someone had already been inside.

There is worse living in this same layer. A few years ago researchers found the first known implant built into the iLO management firmware, sitting inside the chip itself. It quietly blocked attempts to update the firmware while reporting that the update had succeeded, so an administrator believed the machine was clean while the implant kept wiping the disks underneath. Because it lived in the chip and not on the disk, reinstalling the operating system did nothing. Ransomware crews have used this same doorway more than once. They reach a server through its management chip, mount their own boot image or drop to a root shell, encrypt or wipe the drives, and leave a ransom note on the login screen. Cases like that have turned up since 2018.

And the management layer keeps producing fresh holes of its own. Last year a flaw turned up in one widely used management firmware, the kind baked into servers from many different brands. It scored the highest possible severity and let an attacker take over the chip remotely with no password at all, and went straight onto the government’s list of bugs known to be exploited in the wild.

What changed is what these servers are now worth. The boom in AI runs on rented graphics cards, and much of that hardware is rented bare metal, the full physical machine handed to one customer with no virtualization layer in between. That layer, in an ordinary cloud, is part of what keeps one customer separated from the next. Take it away and the hardware itself is the only thing separating one tenant from the next. If the management chip on that hardware is taken over, there is nothing underneath it keeping the tenants apart. The researchers put it directly: in these AI data centers, where the same bare-metal machine often passes from one customer to the next, a single exposed chip can put several companies’ work at risk at once. It gets sharper still. An attacker who rents a machine, plants something in the chip, and hands it back can wait for the next tenant to inherit it, because a normal wipe and reinstall never reaches the chip.

So the servers got more expensive, packed with graphics cards that cost tens of thousands, while the thing guarding them stayed a ten-letter sticker password. And those same graphics cards are what crack the password.

None of this is a shock to the people who were watching. In 2013 a researcher named Dan Farmer mapped this exact weakness and wrote it up under a title that fit it, Freight Train to Hell. That same year a second scan counted more than 300,000 of these chips exposed on the internet, most of them running an even older version with no encryption at all. Thirteen years later the count is smaller but the hole is identical, the same protocol, the same weak passwords, now guarding far more expensive machines. As the team behind the new scan put it, the flaw is not new, but the risk around it has changed.

You can check your own servers in one line. Point it at the management address and see whether the chip answers on its port:

1

nmap -sU -p 623 203.0.113.10

If it responds, that chip is reachable from wherever you ran the scan, and so are the others like it. The fix costs nothing.

• → The management chip should never be reachable from the public internet. Block UDP port 623 at the edge:

1

ufw deny 623/udp

• → Put the management interfaces on their own separate network, reachable only through a VPN or a jump host, never from the open web.
• → Replace the factory password during setup with something long and random, not the one on the sticker.
• → Turn off the old, weak options: IPMI 1.5, cipher zero, and anonymous logins.
• → Monitor that management network on its own, apart from the rest.

The official guidance from CISA and the NSA says the same thing in more words. Treat these chips as one of the most sensitive things you own, because whoever holds one holds the machine, and nothing running inside it can stop them.

Finding the systems people left exposed, and cracking the passwords they leak, are two of the things I teach in my ethical hacking course. You start from zero and learn to do both by hand, with the same tools used here:

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Lava | NVD | CISA