24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Cybersecurity researchers have sounded an alert after finding more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing Intelligent Platform Management Interface (IPMI) protocol to the public internet. Of the 36,872 internet-exposed server-management interfaces running IPMI, 24,650 have been found to disclose password-derived authentication hashes before login due to

Researchers report that 36,872 internet-exposed BMC IPMI interfaces were found, of which 24,650 disclose password-derived authentication hashes before login due to the long-known IPMI v2.0 design issue tracked as CVE-2013-4786.[2] This flaw lets remote attackers obtain HMAC-SHA1 authentication material from BMCs and perform offline password-cracking, with thousands of systems still using weak or default credentials.[2][1] From a RealGround perspective, this illustrates a critical supply-chain and infrastructure-layer weakness that can undermine any AI or data workloads hosted on affected servers, including model storage and training pipelines. Organizations should treat BMC/IPMI exposure as an AI supply chain risk: ensure management networks are isolated, block IPMI from the public internet, rotate factory credentials, disable legacy IPMI options where possible, and incorporate BMC/IPMI checks into AI infrastructure security reviews and SBOM-driven asset inventories.