{"id":22908,"date":"2026-07-30T06:30:03","date_gmt":"2026-07-30T06:30:03","guid":{"rendered":"https:\/\/scannn.com\/how-we-hacked-thousands-of-data-centers-in-minutes-using-a-20-year-old-vulnerability\/"},"modified":"2026-07-30T06:30:03","modified_gmt":"2026-07-30T06:30:03","slug":"how-we-hacked-thousands-of-data-centers-in-minutes-using-a-20-year-old-vulnerability","status":"publish","type":"post","link":"https:\/\/scannn.com\/lv\/how-we-hacked-thousands-of-data-centers-in-minutes-using-a-20-year-old-vulnerability\/","title":{"rendered":"How We Hacked Thousands of Data Centers in Minutes Using a 20-Year-Old Vulnerability"},"content":{"rendered":"\n
\n

A Baseboard Management Controller (BMC)<\/strong> is a highly privileged management processor that provides remote control over a server independently of its operating system. It allows administrators to manage and troubleshoot servers remotely, eliminating the need for physical access to the hardware.<\/p>\n

We identified 36,872 internet-exposed server-management interfaces<\/strong> running IPMI, a protocol introduced more than two decades ago for remote control over physical servers. Of the systems we tested, 24,650 disclosed password-derived authentication hashes before login<\/strong> because of CVE-2013-4786, a vulnerability in the IPMI 2.0 authentication protocol that enables offline password-cracking attempts. To visualize the scale of the exposure, we created BMCRadar<\/strong><\/a>, an interactive map of the internet-exposed BMC interfaces identified during this research.<\/p>\n

More than 30% of the returned hashes<\/strong> were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats. We also found evidence that servers with internet-exposed BMC interfaces are already being targeted and exploited in the wild<\/strong>.<\/p>\n

The exposure also affected modern Supermicro and HPE servers operated by GPU providers<\/strong>, including systems that were still using factory-issued passwords.<\/p>\n

The risk extended well beyond a single server. In the environments we examined, BMC management networks lacked effective segmentation, access controls, and monitoring. A compromised BMC could therefore serve as a highly privileged foothold, allowing an attacker to reach additional management interfaces and put large portions of the data center infrastructure at risk<\/strong>.<\/p>\n

What Is a BMC and Why Is It So Powerful?<\/h2>\n

A Baseboard Management Controller (BMC)<\/strong> is a dedicated service processor attached to most modern server platforms. It is designed to manage the server even when the operating system is down, broken, or completely unresponsive<\/strong>.<\/p>\n

A BMC can usually power-cycle the host, expose a remote console, mount virtual media, update firmware, read hardware sensors, and change low-level platform configuration. In practice, it is one of the most privileged control points in a data center<\/strong>.<\/p>\n

BMCs commonly expose several management surfaces:<\/p>\n