Researchers Find 24,650 Internet-Exposed Servers Leaking IPMI Authentication Material
Summary
Lava researchers found 24,650 internet-exposed servers leaking authentication material through CVE-2013-4786. They also found weak credentials and an exposed HPE iLO 4 page displaying a ransom note, but said this does not prove widespread exploitation.
Key points
- Researchers identified 36,872 internet-accessible IPMI services; 24,650 exposed authentication material usable for offline password cracking.
- The exposure involves CVE-2013-4786, an IPMI 2.0 authentication weakness.
- Researchers found 6,240 hosts accepted an empty username and had weak passwords; 2,340 instances used weak administrator passwords matching public dictionaries.
- Supermicro systems and HPE iLO 4 instances were among the exposed systems; researchers described factory-password patterns that could make offline cracking practical.
- Lava found an exposed HPE iLO 4 login page displaying a ransom demand for 0.3 BTC, but said this does not establish widespread exploitation or successful attacks.
- Recommended measures include keeping IPMI and Redfish off the public internet, rotating default BMC passwords, isolating management networks, and disabling legacy IPMI authentication.
Article Details
- Event Type
- Exposure of internet-accessible IPMI 2.0 interfaces vulnerable to CVE-2013-4786
- Impact
- Lava researchers found 36,872 internet-exposed hosts, including 24,650 exposing authentication material usable for offline password cracking. They reported weak credentials on many systems, including factory defaults and dictionary-matching passwords. Access to a BMC could enable control of server hardware and potentially affect workloads sharing a physical server. Researchers also found an exposed HPE iLO 4 page displaying a ransom note, but said this does not establish widespread exploitation or successful attacks.