BMC vulnerabilities exposed in enterprise servers

At the Black Hat security conference, firmware security expert H. D. Moore presented research revealing widespread critical vulnerabilities in baseboard management controllers (BMCs) embedded in enterprise servers from major manufacturers including HPE, Supermicro, Dell, Lenovo, Huawei, and others. BMCs are miniature computers that manage servers remotely, even when powered off. Moore's scans found over 86,000 Internet-exposed BMCs, with more than 54% containing critical vulnerabilities, and an internal scan of 126,761 BMCs found nearly 29% with critical flaws. Many devices remain vulnerable to CVE-2013-4786, a decade-old IPMI authentication flaw. The vulnerabilities span authentication bypasses, encryption failures, predictable session IDs, memory corruption, unsigned firmware, and extractable secrets. Real-world exploits like ILObleed demonstrate the severity. Moore released an open-source scanner, OOBscan, to help administrators detect vulnerable BMCs.