Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks

Over 24,000 internet-accessible server-management interfaces are exposing authentication hashes before any login completes. SecurityWeek reports the issue as a decades-old BMC vulnerability that leaves thousands of data centers open to attack through those interfaces alone.

A BMC is the out-of-band controller used to power-cycle hosts, inspect hardware health, and reach the console when the main OS is down. The flaw is that these management planes hand out authentication hashes before a successful login, so an unauthenticated client on the network path can collect credential material instead of facing a closed login gate.

For engineers and builders, that breaks the usual assumption that management interfaces only become useful after credentials succeed. Hashes obtained pre-login can feed offline cracking and reuse attempts against the same BMC or related admin paths, and because BMCs sit below the guest OS, compromise can outlive OS reinstalls and ordinary application patching.

In market terms, internet-facing BMCs turn a local rack problem into a remote one at scale: more than 24,000 reachable interfaces means attackers can scan and harvest without first owning a foothold inside a customer network. Operators who left management planes on public IPs for convenience now sit in the same exposure set as sites that never intended that surface to be world-reachable.

Practical next step: inventory every BMC and similar server-management endpoint, confirm none answer on the public internet, and put them on management-only networks with strict access control. Watch for whether those pre-login hash disclosures stop after network isolation and firmware or configuration fixes, and treat any remaining internet-reachable BMC as an active incident until it is closed.