24,000 Exposed Server BMCs Leak Password Hashes: Why Remote Admin Should Not Be Public

Lava published research warning that thousands of Baseboard Management Controller interfaces are reachable from the public internet and can leak password-derived authentication material through a long-known IPMI 2.0 weakness. The company says it identified 36,872 internet-exposed IPMI hosts, with 24,650 returning at least one password-derived RAKP authentication response before client authentication completed.

The issue maps to CVE-2013-4786. NVD describes it as an IPMI 2.0 RMCP+ RAKP weakness that allows remote attackers to obtain password hashes from a BMC and conduct offline password-guessing attacks. BleepingComputer reported Lava's findings on 28 July, including weak or predictable credential patterns and exposed server-management interfaces on UDP port 623.

A BMC is not just another admin login. It is the out-of-band controller used to power-cycle, monitor and manage a physical server even when the main operating system is down. Shadowserver warns that anyone who can control your BMC via IPMI can control your server, which is why public exposure is treated as high risk.

The offline-cracking angle makes this worse. If an attacker can request authentication material and then test guesses away from the target, weak, reused or factory-derived passwords may fall without producing the normal pattern of repeated failed logins. For GPU, hosting, small-business and self-hosted environments, one exposed management interface can become a route below normal endpoint visibility.

If you administer servers, check whether IPMI, iLO, iDRAC, Redfish or other BMC interfaces are exposed to the internet. Pay special attention to UDP port 623, browser-based management pages and shared management credentials. Remove public exposure, restrict access to a dedicated management network or tightly controlled admin VPN, rotate factory passwords and disable unused legacy IPMI features where your hardware supports it.

Small businesses using a managed IT provider should ask a direct question: are server management controllers reachable only from a protected management path, and are BMC credentials unique rather than reused? If exposure existed, treat password rotation as only one step; review access logs, firmware state and nearby management systems for signs of misuse.

A private administrative VPN can be part of the right design when it keeps management interfaces away from the public internet and limits access to trusted administrators. Used that way, a VPN is an exposure-reduction control for the management plane.

A consumer VPN app on your laptop does not harden an exposed BMC, change weak IPMI passwords, block UDP port 623 at the firewall, or detect compromise below the operating system. The fix is network segmentation, allowlisting, credential rotation, firmware review, logging and removing public BMC access.

This is the enterprise version of a familiar home-router lesson: remote administration should be private by default. The more privileged the interface, the less it belongs on the open internet.

For VPN Rocks readers choosing privacy tools, the nuance matters. VPNs can be very useful, but the best security designs use them to reduce exposure around specific admin paths rather than treating them as magic shields for unsafe services.