A 20-year-old flaw is leaking passwords from 24,000 servers online

Key points

• Researchers at Lava found 36,872 servers with their remote management interface exposed to the open internet, and 24,650 of them leak password data usable for offline cracking.
• The weakness, CVE-2013-4786, sits in a management protocol first drafted back in 2004.
• Around 6,240 servers accepted a blank username, and 2,340 used administrator passwords found in public wordlists.
• 39% of the exposed servers sit in the United States, with Supermicro hardware heavily represented.
• Lava spotted one HPE server already carrying a ransom note demanding 0.3 bitcoin.

A cybersecurity startup called Lava has found more than 24,000 servers on the public internet that quietly hand out enough information for an attacker to work out the administrator password offline. The flaw is old. It was assigned a tracking number, CVE-2013-4786, back in 2013, and the underlying protocol dates to 2004.

In practice this is not a fancy new attack. It is a very old one that nobody cleaned up.

What is actually exposed here?

The exposed piece is called a BMC, short for Baseboard Management Controller. Think of it as a tiny second computer soldered onto the main server board, whose only job is to let an administrator switch the machine on, reinstall it, or fix it from the other side of the world. It runs even when the main server is off.

That is enormously useful for the people running data centres. It is also enormously useful for an attacker, because a BMC sits underneath the operating system and underneath most security tools watching the machine.

Gain the BMC, gain the server. Firmware, boot process, virtual disks, all of it.

How did the researchers get in?

They asked politely. The old management protocol, IPMI 2.0 (a standard for talking to BMCs over the network), will happily send back a chunk of data during the login handshake that is mathematically tied to the real password. An attacker who captures that chunk can then sit offline with a graphics card and guess passwords at high speed until one fits.

Lava scanned the internet on the port IPMI uses. Of 36,872 servers that answered, 24,650 coughed up this crackable material.

The results were worse than the raw number suggests. 6,240 machines accepted an empty username. 2,340 were using admin passwords straight out of public password lists. Many Supermicro boxes still had the ten-character uppercase password printed on the sticker on the chassis, with the username left as ADMIN. On a modern Apple M3 laptop, Lava estimated an HPE factory password would fall in roughly a day per captured handshake.

Is anyone actually exploiting this?

At least someone is. First reported by BleepingComputer, Lava came across an HPE iLO 4 management page sitting on the open internet with a ransom note pinned to it, demanding 0.3 bitcoin. That is one server, not a campaign, but it shows criminals are already poking at these interfaces.

The bigger worry is AI and cloud hosting. One physical server often runs workloads for several customers at once. Break the BMC on that box and you potentially reach into all of them.

What did the vendors say?

Supermicro told Lava that its guidance already tells administrators to change the sticker password and keep management networks separate from the public internet, and said it would look at stronger default passwords in future hardware. HPE, according to Lava, sent an auto-reply and nothing else.

One thing the post-mortem will say is that the guidance existed and nobody followed it. Management interfaces should never have been on the public internet in the first place.

Operational takeaway: if your BMC answers a scan from the open web, treat that server as already borrowed.