Loading story…
Researchers at Lava found that 24,650 internet-exposed Baseboard Management Controllers (BMCs) leak password-derived authentication material through CVE-2013-4786, a long-known weakness in the IPMI 2.0 handshake over UDP port 623. Across 36,872 publicly reachable IPMI services identified via Shodan, the exposed systems returned data before login that can be used for offline password cracking, bypassing account lockouts and failed-login monitoring. The issue affects out-of-band management interfaces that can grant low-level server control, including remote administration and firmware operations independent of the host operating system.
The researchers said they recovered valid credentials for at least a third of tested systems using dictionaries and factory-password patterns, with Supermicro devices frequently using predictable 10-character uppercase defaults tied to the ADMIN account and HPE iLO systems also showing crackable factory schemes. They also observed an exposed HPE iLO 4 login page displaying a ransom note, indicating at least some BMC interfaces may already have been compromised. Recommended mitigations include removing IPMI and Redfish from the public internet, blocking UDP 623, rotating factory and weak BMC passwords, disabling legacy IPMI authentication options, and restricting management access to isolated networks, VPNs, or bastion hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In a July 2, 2013 blog post, Rapid7 published Dan Farmer's research describing several IPMI/BMC security weaknesses, including retrieval of salted password hashes for offline cracking, abuse of cipher 0, default or anonymous accounts, and Supermicro-specific flaws. The post also explained how BMC compromise can lead to host compromise and persistence via BMC backdoors.
A long-known IPMI 2.0 weakness tracked as CVE-2013-4786 allows exposed Baseboard Management Controller interfaces to return password-derived authentication material before login, enabling offline password cracking.
After identifying the exposure and credential risks, Lava notified Supermicro and HPE and recommended removing IPMI and Redfish from the public internet, rotating factory passwords, isolating management networks, and disabling legacy IPMI authentication.
The researchers found at least one exposed HPE iLO 4 login page displaying a ransom note, indicating unauthorized access or malicious activity targeting publicly reachable BMC management interfaces.
Lava researchers found 36,872 internet-accessible IPMI/BMC services on UDP port 623 and determined that 24,650 exposed material usable for offline password cracking. They also recovered valid passwords for at least a third of affected systems, with Supermicro and HPE devices notably impacted by factory or weak credential patterns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecybersecuritynews.com
Open sourcehackread.com
Open sourcecyberveille.ch
Open sourcedarkreading.com
Open sourcereddit.com
Open sourcelavahq.io
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
Cisco disclosed multiple vulnerabilities in its Integrated Management Controller (**IMC**), including the critical `CVE-2026-20093`, which allows a remote, unauthenticated attacker to send a crafted HTTP request to bypass authentication and change passwords for existing users, including the primary Admin account. Cisco rated the flaw **CVSS 9.8** and said no workarounds or mitigations are available, making vendor-issued software updates the only effective fix; the company added that it has no evidence of active exploitation or public malicious use. Additional advisories cover `CVE-2026-20094` through `CVE-2026-20097`, spanning command injection and arbitrary code execution issues that could let attackers execute commands or code as `root` and fully compromise affected systems. Impacted products include Cisco UCS C-Series and S-Series servers, UCS E-Series systems, Catalyst 8300 Series Edge uCPE, 5000 Series ENCS, and other Cisco appliances built on vulnerable UCS platforms, with Cisco publishing fixed-version guidance and upgrade paths while runZero released an inventory query to help organizations identify exposed IMC assets.
Jun 29, 2026
Dell disclosed and researchers detailed **CVE-2026-40639** (`DSA-2026-197`), a BIOS password storage weakness that allows administrator and user passwords to be recovered from SPI flash dumps in milliseconds on affected Dell client platforms. The flaw affects the `SystemPwSmm` SMM driver and stems from storing password records in the DVAR region with a reversible repeating 20-byte XOR scheme over a 32-byte field, while leaving the first password character unencrypted. For passwords of 12 characters or fewer, leaked key material is sufficient for deterministic recovery without brute force; researchers also reported that longer passwords are often recoverable because deleted DVAR records are not securely erased and key derivation is limited by device-specific values. Confirmed vulnerable systems include the **Wyse 5070** thin client and reported examples such as the **Latitude E7250**, **Latitude 7490**, and **XPS 15 9560**, although some newer Dell platforms were found to use stronger protections and were not affected. The attack requires physical access to read SPI flash or the ability to boot an attacker-controlled OS, but recovered BIOS credentials could let an attacker change settings tied to **Secure Boot**, boot order, and pre-boot DMA controls, potentially weakening some full-disk encryption assumptions. Dell validated the report after private disclosure, issued patches for some product lines, and said additional fixes were planned, though some confirmed vulnerable devices remained unpatched at publication time.
Jul 13, 2026