An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced in 2004.
That controller runs underneath the operating system. It power-cycles the host, mounts virtual media, opens a remote console, and flashes firmware. Host security tools watch the layer above it.
Example BMC web interface (Source: Lava)
36,872 of these controllers answered from the public internet, and were identified via Shodan by Lava researchers. 24,650 of them returned password-derived authentication material before the client had authenticated. The weakness carries a name and a decade of age: CVE-2013-4786.
Two-thirds of them leak a hash
The response contains an HMAC-SHA1 code computed over the account password and session values the requester already holds. Guessing then moves offline, onto the attacker’s hardware. One request to the BMC covers every password candidate. Detection built on repeated failed logins has nothing to catch.
About a third of the captured hashes were assessed as recoverable from public wordlists or predictable factory formats. On 2,340 endpoints, a named account such as ADMIN or root matched a password sitting in a wordlist anyone can download. Many of those fell on the first pass, within minutes.
Roughly one in six of the exposed hosts answered for an empty username, with a weak password behind it.
Unique factory passwords crack too
Supermicro hardware made up the majority of responding BMCs in the dataset. The company’s servers are common across data centers, hosting environments, and GPU infrastructure. The company moved off the shared ADMIN password years ago to satisfy California’s SB-327. The username stayed ADMIN. The password moved to a sticker on the chassis.
Supermicro’s own specification pins the format down: the preprogrammed password “will consist of a string of exactly 10 uppercase alphabetic letters.”
That gives roughly 141 trillion candidates. Eight GPUs running Hashcat would walk the entire candidate space in an estimated hour.
Lava’s researchers tested two adjacent addresses at a US bare-metal GPU provider whose published policy permits testing of internet-facing systems. Both ran current X13DEM boards. Both passwords came back matching the chassis-sticker format. The researchers stopped at recovery, reported the same day, and the provider closed the exposure.
HPE iLO uses a shorter factory password built from uppercase letters and digits, giving a smaller keyspace still. Commodity hardware grinds through it slowly. A lab server with eight RTX 6000 PRO cards did it in 32 seconds per captured response.
Factory-issued HPE iLO credential label on a server in the Lava lab
Someone already got in
One of the exposed iLO 4 login pages carried a ransom note in its Security Notice panel, claiming RSA-2048 encryption of the server’s data and demanding 0.3 BTC through a disposable email address. Whether anything on the disk was encrypted remains unconfirmed. Someone reached the management interface and edited what it shows.
iLOBleed, a rootkit that lives in iLO 4 firmware, has been documented in earlier research and tied to destructive attacks on servers.
“Organizations have spent years hardening cloud workloads and operating systems, but many have overlooked the infrastructure that sits beneath them,” said Yakir Kadkoda, CTO at Lava. “These management controllers hold the keys to servers and data centers. Once compromised, attackers can operate below the visibility of almost any security tools, maintain persistence even after systems are rebuilt, and potentially move deeper into critical infrastructure. As AI infrastructure rapidly expands, securing this layer has become far more urgent.”
Supermicro says it will look at longer passwords
Lava notified Supermicro in June. The company accepted the scenario as plausible against current multi-GPU cracking capability, repeated its guidance that customers rotate default BMC passwords during setup, and pointed operators toward management VLANs and access control lists. Supermicro also said it will review the default password policy on future hardware revisions, including longer passwords or a wider character set.
Close the port
The remedy is network work. Block UDP 623 at the edge. Replace factory credentials during provisioning, and disable IPMI 1.5, cipher suite 0, anonymous accounts, and NONE authentication. Put BMC access behind a dedicated management network, a VPN, or a bastion host. Redfish over TLS covers ordinary administrative work, though it belongs on the isolated management network too. IPMI exposure leaves the hash sitting there for anyone who asks.