How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability | Lava<br>How We Hacked Thousands of Data Centers Using a 20-Year-Old Vulnerability|See how we did it<br>Introducing FORGE: A Practical Security Framework for Data Centers And AI Infrastructure|Explore FORGE<br>How We Hacked Thousands of Data Centers Using a 20-Year-Old Vulnerability|See how we did it

Table Of Contents

A Baseboard Management Controller (BMC) is a highly privileged management processor that provides remote control over a server independently of its operating system. It allows administrators to manage and troubleshoot servers remotely, eliminating the need for physical access to the hardware.

We identified 36,872 internet-exposed server-management interfaces running IPMI, a protocol introduced more than two decades ago for remote control over physical servers. Of the systems we tested, 24,650 disclosed password-derived authentication hashes before login because of CVE-2013-4786, a vulnerability in the IPMI 2.0 authentication protocol that enables offline password-cracking attempts. To visualize the scale of the exposure, we created BMCRadar , an interactive map of the internet-exposed BMC interfaces identified during this research.

More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats. We also found evidence that servers with internet-exposed BMC interfaces are already being targeted and exploited in the wild .

The exposure also affected modern Supermicro and HPE servers operated by GPU providers , including systems that were still using factory-issued passwords.

The risk extended well beyond a single server. In the environments we examined, BMC management networks lacked effective segmentation, access controls, and monitoring. A compromised BMC could therefore serve as a highly privileged foothold, allowing an attacker to reach additional management interfaces and put large portions of the data center infrastructure at risk .

What Is a BMC and Why Is It So Powerful?

A Baseboard Management Controller (BMC) is a dedicated service processor attached to most modern server platforms. It is designed to manage the server even when the operating system is down, broken, or completely unresponsive .

A BMC can usually power-cycle the host, expose a remote console, mount virtual media, update firmware, read hardware sensors, and change low-level platform configuration. In practice, it is one of the most privileged control points in a data center .

BMCs commonly expose several management surfaces:

IPMI , the older out-of-band management protocol

Redfish , the newer HTTPS-based management API

A browser-based administrative interface

Remote console and virtual media features, depending on the platform

In many implementations, these interfaces share the same user database . A credential that works for IPMI may also work for the web interface or Redfish API. This matters because the IPMI authentication process can expose information that enables offline password recovery .

BMC implementations differ across vendors. HPE calls its platform iLO , Dell calls it iDRAC , Lenovo uses XClarity Controller , and Supermicro provides its own BMC stack. OpenBMC is an open-source BMC firmware stack used across parts of the cloud, hyperscale, and hardware ecosystem.

Figure 1: Example BMC web interface. BMCs often expose web, API, console, and IPMI management surfaces backed by the same privileged management plane.

A compromised BMC puts defenders in a uniquely difficult position. Most security tools monitor the operating system, kernel, containers, and workloads. The BMC operates outside that trust boundary , giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.

The risk rarely stops at one server. BMCs typically sit on shared out-of-band management networks, where administrative credentials are often reused and traffic is monitored less closely than on production networks. This gives attackers a path to move laterally between management controllers , turning one compromised BMC into a foothold across the broader data center management plane.

BMC access can also enable persistence below the operating system . Malicious changes to BMC or other platform firmware can survive operating system reinstalls, disk replacement, and standard incident response procedures. Recovering trust becomes a platform-level recovery problem , requiring verified firmware reflashing, integrity validation, vendor-assisted recovery, or hardware replacement when the affected components can no longer be trusted.

Why BMC Compromise Is Especially Dangerous in AI Infrastructure

AI infrastructure concentrates thousands of high-value GPU systems behind shared management networks. These environments also rely heavily on shared storage, high-speed interconnects, and multi-tenant operational...