Over 86,000 Exposed Server Management Chips Vulnerable to Remote Takeover, Research Shows

LAS VEGAS — Tens of thousands of enterprise servers running hardware from major vendors including HPE, Dell, and Supermicro remain exposed to cyberattacks through low-level management chips, according to research presented at the Black Hat security conference in Las Vegas.

Scans of global infrastructure revealed more than 86,000 baseboard management controllers (BMCs)—dedicated microprocessors embedded on server motherboards—directly accessible over the public internet, with 54% harboring critical vulnerabilities. Internal network assessments showed an additional 126,761 controllers scanned across enterprise environments, nearly 29% of which contained at least one critical defect capable of giving attackers full administrative control over the underlying hardware.

“The end result is a pervasive, under-monitored, under-patched parallel attack surface that is both Internet-exposed and widespread inside corporate networks, and is much more exploitable than many folks realize,” said HD Moore, founder and chief executive officer of cybersecurity firm runZero, who disclosed the findings.

Among the newly revealed flaws presented by Moore are pre-authentication memory corruption bugs in HPE iLO systems. A length-validation defect in the management SSH service permits unauthenticated remote code execution, granting attackers direct entry to the controller before any login checks occur. Flaws spanning session security, predictable authentication tokens, and hardcoded secrets were also identified across hardware from Lenovo, Huawei, Avocent, H3C, and Nvidia.

The research highlights how systemic flaws dating back more than a decade continue to haunt enterprise data centers. Roughly 75,000 internet-facing BMCs remain susceptible to CVE-2013-4786, a 2013 flaw in the IPMI 2.0 protocol that allows attackers to capture password hashes and crack administrator credentials offline. Weak factory settings exacerbate the threat, with HPE using eight-character default passwords that Moore categorized as the weakest approach, while Supermicro and Dell utilize slightly longer default credentials that delay offline recovery attempts by only hours or days.

In other cases, IPMI implementations fail to enforce session encryption and integrity. “The device decides whether to authenticate and decrypt each packet from that attacker’s own header, and not from the algorithms the session negotiated, so an unsigned, unencrypted command is accepted on a secured session,” Moore said, demonstrating a proof-of-concept exploit that chains unexploitable issues into full session control across HPE, Supermicro, and legacy Intel systems. Predictable session tokens generated via simple counters allow attackers to hijack active browser-based KVM consoles, with Supermicro devices suffering two of the most critical vulnerabilities of this type.

At the firmware layer, unsigned updates and exposed cryptographic keys allow attackers who achieve partial access to gain permanent persistence. Embedded keys extracted from publicly available firmware images for Supermicro, OpenBMC, Huawei, and Dell systems can be reused to decrypt server traffic or authenticate to controllers. Once inside, intruders can flash backdoored or legacy firmware versions onto the BMC, leveraging hardware-level access to manipulate operating systems even when primary servers are powered down.

To assist network defenders, Moore released OOBscan, an open-source scanner designed to audit server fleets for out-of-band management risks. Hardening recommendations include isolating BMC network interfaces off shared VLANs, disabling IPMI and Keyboard Controller Style (KCS) interfaces where feasible, blocking host-side access, and replacing default passwords with complex credentials.

“BMCs are still an underrated risk,” Moore wrote. “This work points to the ecosystem being well behind the curve in terms of code quality and architecture.”