A 20-year-old flaw is leaking passwords from 24,000 servers online

Key points

• Researchers at Lava found 36,872 servers with their remote management interface exposed to the open internet, and 24,650 of them leak password data usable for offline cracking.
• The weakness, CVE-2013-4786, sits in a management protocol first drafted in 2004.
• Around 6,240 servers accepted a blank username, and 2,340 used administrator passwords found in public wordlists.
• 39% of the exposed servers sit in the United States, with Supermicro hardware heavily represented.
• Lava found one HPE server already carrying a ransom note demanding 0.3 bitcoin.

A cybersecurity startup called Lava has found more than 24,000 servers on the public internet that quietly hand out enough information for an attacker to crack the administrator password offline. The flaw isn't new. It got its tracking number, CVE-2013-4786, back in 2013, and the underlying protocol dates to 2004. This is a very old problem that nobody cleaned up.

What is actually exposed here?

The exposed component is called a BMC, short for Baseboard Management Controller: a tiny second processor soldered onto the main server board whose job is to let an administrator switch the machine on, reinstall it or fix it remotely. It runs even when the main server is off.

That's enormously useful for data centre operators. It's also enormously useful for an attacker, because a BMC sits below the operating system and below most security tools watching the machine. Gain the BMC and you've got the server. Firmware, boot process, virtual disks, all of it.

How did the researchers get in?

They asked politely. IPMI 2.0, the standard protocol for talking to BMCs over the network, sends back a chunk of data during the login handshake that's mathematically tied to the real password. Capture that chunk, take it offline, run it against a GPU rig, and you can guess passwords at high speed until one fits.

Lava scanned the port IPMI uses and found 36,872 servers that answered. Of those, 24,650 returned this crackable material. The breakdown was worse than the headline number. A total of 6,240 machines accepted an empty username. Another 2,340 were running admin passwords straight out of public wordlists. Many Supermicro boxes still carried the ten-character uppercase password printed on the chassis sticker, username left as ADMIN. On an Apple M3 laptop, Lava estimated an HPE factory password would fall in roughly a day per captured handshake.

Is anyone actually exploiting this?

At least someone is. First reported by BleepingComputer, Lava came across an HPE iLO 4 management page sitting on the open internet with a ransom note demanding 0.3 bitcoin. One server, not a campaign, but it confirms criminals are already scanning these interfaces.

The wider concern is shared infrastructure. Lava's researchers noted that a single physical GPU server can support multiple tenants through virtualisation or GPU partitioning, so one compromised BMC could expose several customers at once. That's not a theoretical edge case in AI hosting environments where segmentation is often an afterthought.

What did the vendors say?

Supermicro told Lava its guidance already advises administrators to change default passwords and isolate management networks, and said it would review stronger defaults for future hardware. HPE sent an auto-reply and nothing further, according to Lava.

We first covered BMC exposure on 28 July 2026, and the vendor response has barely moved since then. Guidance existed. Nobody followed it. Management interfaces never should've been on the public internet.

If your BMC answers a scan from the open web, treat that server as already borrowed.