https://hackingpassion.com/tags/bmc/Recent content in BMC on HackingPassion.com : root@HackingPassion.com-[~]HugoenThu, 30 Jul 2026 14:08:32 +0200https://hackingpassion.com/ipmi-bmc-password-hash-exposed-servers/Thu, 30 Jul 2026 14:08:32 +0200https://hackingpassion.com/ipmi-bmc-password-hash-exposed-servers/<p>A flaw more than 20 years old just left <strong>36,872</strong> servers reachable straight from the internet. Not the websites they run, the servers themselves, through the one small chip that controls them even when they are powered down. Of those, <strong>24,650</strong> handed over what an attacker needs to crack their password, before a single person had logged in, and there is no patch on the way. 🧐</p> <p>Server-class machines carry a second, smaller computer built onto the motherboard. It has its own processor, its own network port, and its own power, and it runs whether the server is switched on or off. Its job is to let an administrator manage the machine from far away: power it on, reboot it, reinstall it, watch the screen, all without walking into the data center. Different brands give it different names, iLO, iDRAC, or just the IPMI interface, but underneath it is the same part, a <strong>baseboard management controller</strong>, a <strong>BMC</strong>.</p>