The BMC Security Mess: 75,000 Servers Exposed

At Black Hat 2026, HD Moore, CEO of runZero, presented research showing that baseboard management controllers (BMCs) from major manufacturers remain a pervasive security hole. Over 86,000 BMCs are exposed to the internet, and 75,000 of them are still vulnerable to CVE-2013-4786, a 13-year-old IPMI authentication flaw. That's a 54% critical vulnerability rate.

What Are BMCs and Why Should You Care?

BMCs are miniature computers embedded in server motherboards. They run their own firmware and OS, with independent network access. Administrators use them for lights-out management: rebooting, updating, even reinstalling OSes, all without physical access. They're powerful, but they're also a parallel attack surface that's under-monitored and under-patched.

The Vulnerabilities: Not Just Old, But New

Moore found over a dozen new vulnerabilities across HPE, Supermicro, Avocent, Huawei, Lenovo, and Dell. He also confirmed that flaws he reported in 2013 remain active. The bug classes include:

  1. IPMI authentication handshake flaws: Attackers can alter the message sequence to bypass authentication. Affects HPE iLO, Supermicro, OpenBMC, and OpenBMC-derived products from H3C and Nvidia.
  2. In-session integrity/encryption failures: The device decides whether to authenticate/decrypt each packet based on the attacker's header, not the negotiated session. Moore chained these to gain full sessions. Affects HPE, Supermicro, Intel (legacy).
  3. Predictable session identifiers: Tokens generated from counters or clocks, not secure random. Allows session hijacking. Two most significant bugs are in Supermicro systems.
  4. Pre-authentication memory corruptions: A length-validation error in the SSH service is reachable pre-auth and can execute code. Found in HPE iLO.
  5. Unsigned/attacker-controllable firmware: An authenticated admin can install persistent implants or replace verification keys. Affects Supermicro, H3C, Dell.
  6. Secrets recoverable from firmware: Keys extracted from public firmware authenticate or decrypt traffic. Affects Supermicro, OpenBMC, Huawei, Dell.
  7. Default/factory-random credentials: CVE-2013-4786 enables offline cracking. HPE uses 8-digit alphanumeric passwords, while Supermicro and Dell use slightly longer defaults.

Real-World Exploitation: ILObleed and Beyond

In 2021, ILObleed used a patched BMC vulnerability to wipe hard drives, surviving OS reinstalls and disk swaps. Last year, CISA added an AMI BMC vulnerability to its known exploited list. These aren't theoretical.

Scanning Your Fleet: OOBscan

Moore released OOBscan, an open-source tool to scan your servers for BMC vulnerabilities. Run it now:

# Example: scan a range for BMCs
./oobscan scan --target 192.168.1.0/24 --protocols ipmi,https

Mitigations: What to Do Now

  • Set long, unique usernames and complex passwords.
  • Disable IPMI and KCS (host-side access) wherever possible.
  • Isolate each BMC NIC individually; avoid shared VLANs.
  • Patch firmware immediately.

The Bottom Line

BMCs are still an underrated risk, as Moore put it. The ecosystem is "well behind the curve in terms of code quality and architecture." If you manage servers, treat BMCs as untrusted and segment them aggressively. Run OOBscan now.