Dateline: July 29, 2026
The Second Computer Inside Your Servers Just Became Every Attacker’s Favorite Door
Roughly 24,000 servers can be hijacked through a weakness that has been sitting in plain sight since 2004. Researchers found ransom notes already pinned to some of them. One victim runs parts for cars you probably drive.
What Happened?
Security researchers scanned the open internet for a specific kind of server brain. It is called a Baseboard Management Controller (BMC). Think of it as a tiny second computer bolted onto the motherboard. It lets admins reboot a server, watch its health, and take control even when the main machine is dead.
That much power makes it a prize.
The team found 24,650 of these controllers answering the internet in a way they never should. Each one leaked a scrambled version of its login password to anyone who asked. No login required. The attacker just grabs the scramble and cracks it later on their own machine, with no alarms tripping back at the data center.
The root cause is CVE-2013-4786, a flaw baked into the IPMI 2.0 standard when it launched in 2004. It got a public CVE in 2013. It carries a severity score of 7.5 out of 10. It is not new. It just never got cleaned up.
Of the exposed controllers, 6,240 accepted blank usernames paired with weak passwords. Another 2,340 used names like ADMIN or root with passwords sitting in common wordlists. In plenty of cases, researchers cracked them in minutes. Even some factory default passwords followed such predictable patterns that they fell too.
What’s the Impact?
A BMC lives below the operating system. That is the scary part. Your antivirus, your endpoint tools, your kernel monitoring, none of them can see it. The controller sits in a blind spot by design.
So an attacker who cracks one password gets a foothold that most defenses cannot watch. From there they can power servers on and off, mount fake drives, rewrite firmware, and crawl sideways across the management network to reach more machines. In a shared GPU cloud, that path can even lead into other customers’ systems.
Researchers confirmed this is not theory. They found a major automotive parts maker with multiple exposed servers already carrying ransom notes and payment demands. A separate exposed controller showed its own ransom message. Cleanup from this kind of hit can mean reflashing firmware or replacing hardware outright.
How to Avoid This
Pull BMC and IPMI interfaces off the public internet first. That is the single biggest fix. Then keep going.
Put management controllers on their own isolated network, walled off from everything else. Lock access down to a few tightly controlled admin paths. Rip out every factory and reused password. Turn off old insecure features you do not use. And watch the out of band network all the time, because a quiet BMC compromise can sit undetected for months.
Your Blind Spot Has a Second Computer In It
You cannot defend a machine you cannot see. Most teams do not even have these controllers on their asset list.
Secure.com’s Infrastructure Security Teammate closes that gap by working the way the attacker does: always on, always looking.
- Finds and inventories exposed assets like BMCs that slip past normal scans, so nothing lives in your blind spot.
- Maps the external attack surface from a hacker’s point of view, flagging what is reachable from the open internet.
- Calculates blast radius, showing which systems fall next if one controller gets popped.
- Detects weak, default, and reused credentials against baseline configuration rules.
- Surfaces exposure in minutes instead of the months an attacker needs to move.
