86,000 exposed server management chips. HD Moore found critical flaws in more than half.

HD Moore says the chip that manages most enterprise servers is still broken. At Black Hat USA, the runZero founder disclosed more than a dozen new vulnerabilities in baseboard management controllers, the small computers bolted onto server motherboards. An external scan turned up 86,000 of them facing the open internet.

That count matters because of where the code lives. A BMC runs its own processor, its own firmware and its own network stack, with an IP address separate from the server’s, and it stays awake while the machine is powered off. An attacker who reaches administrative control can reflash it. The implant then sits underneath every operating system that box ever boots. Reinstalling Linux won’t touch it. Wiping the disk won’t either. Moore’s second scan, this one inside corporate networks, counted 126,761 BMCs, and close to 29 percent of them carried at least one critical flaw.

What a BMC actually is

Picture a second, much smaller computer soldered onto the server’s motherboard. That’s a BMC. It has its own CPU, its own flash chip holding its own firmware, and usually its own dedicated Ethernet jack on the back panel, physically separate from the ports carrying application traffic. Data-center staff use it for what vendors call lights-out or out-of-band management. Power a dead machine on. Read fan speeds. Watch the console as though someone were standing at the rack. Mount an ISO over the network and reinstall the operating system without touching the hardware. It works when the host is off, hung, or has no OS on it at all, and that is the entire point of it.

Every major server vendor ships one under a brand name. HPE calls it iLO, Dell calls it iDRAC, and Supermicro, Fujitsu and H3C each ship their own. Many of them run AMI MegaRAC underneath, an OEM firmware stack that dozens of manufacturers license, and a growing share run OpenBMC. Two protocols do the talking: IPMI, whose 2.0 specification dates to 2004, and Redfish, the newer HTTPS and JSON interface that replaced it. IPMI listens on UDP port 623. Redfish sits behind the web login most admins actually click through. runZero’s advisory page lists OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM and Fujitsu as the implementations it examined.

Why an implant survives a wipe

BMC firmware doesn’t live on the boot drive. It lives in its own SPI flash chip, and the controller can read and write host memory, present virtual media, and rewrite the system BIOS. The trust relationship runs the wrong way round for a defender: the operating system you would reinstall to clean a compromised server is the thing the BMC controls, not the other way around.

Two of the weakness classes Moore describes make persistence cheap rather than clever. Supermicro, H3C and Dell devices, per the Ars Technica writeup, let an administrator install firmware the device never properly verifies, so an implant or a swapped verification key sticks. Separately, cryptographic keys recoverable straight out of publicly downloadable firmware images, on Supermicro, OpenBMC, Huawei and Dell devices, can be used to authenticate to a BMC or decrypt its traffic. Unsigned management firmware is the same category of problem as Secure Boot’s expiring certificates, one layer further down the stack. Pulling live secrets out of a shipped image is the pattern behind a Hanwha camera that leaked a GitHub admin token.

Nobody has to take the persistence claim on faith. Nozomi Networks Labs demonstrated reset-resistant BMC persistence in July 2023 by writing a cross-site-scripting payload into the BIOS vendor and product name strings, which MegaRAC later rendered on its field-replaceable-unit inventory page. The payload kept firing “despite multiple reinstallations of the host operating system” and through hard resets. That was a 2023 proof against 2021-era firmware. Moore’s 2026 counts say the class never closed.

What the new flaws allow

Ars groups the findings into seven weakness classes, and the most interesting one has nothing to do with a buffer. Several BMCs fail to enforce encryption and integrity on individual packets inside an already-authenticated IPMI session. “The device decides whether to authenticate and decrypt each packet from that attacker’s own header, and not from the algorithms the session negotiated,” Moore told Ars Technica. An attacker who can reach the port gets to declare his own traffic trustworthy.

The rest of the list is the usual embedded-firmware bingo card: IPMI authentication handshakes that can be bypassed by reordering the prescribed message exchange, session identifiers derived from counters or clocks instead of a random source (which lets an attacker ride a live management session), a length-validation bug in HPE iLO’s SSH service that fires before authentication and can execute code, and factory-set passwords weak enough to crack offline. As many as 75,000 of the exposed controllers are still vulnerable to CVE-2013-4786, an IPMI 2.0 flaw published in 2013 that hands an unauthenticated caller a password-derived HMAC-SHA1 value to crack at leisure, without ever tripping a failed-login counter.

A separate measurement backs that up. The firm Lava scanned UDP 623 across the public internet and found 36,872 exposed IPMI services as of May 6, 2026, of which 24,650 (66.9 percent) returned the pre-login hash. Lava also logged 6,240 endpoints that accepted an empty username with a weak password and 2,340 with a named account on a common one. Supermicro hardware made up more than half the dataset, and Supermicro’s factory password is “exactly ten uppercase letters printed on a chassis label”, which sounds strong until a rented GPU chews through the keyspace.

Exploitation of BMC bugs is not hypothetical either. CVE-2024-54085, an AMI MegaRAC Redfish authentication bypass that Eclypsium documented at CVSS 10.0, lets an unauthenticated attacker set the X-Server-Addr or Host header so the BMC believes the request came from its own host. CISA added it to the Known Exploited Vulnerabilities catalog on June 25, 2025, the first BMC flaw to land there. AMI shipped patches in March 2025.

Avocent, Huawei, Lenovo, Raritan and Fujitsu also appear across the affected-vendor and affected-implementation lists. The individual CVE IDs mostly aren’t public: runZero’s page says technical details ship “as coordinated disclosure processes conclude”, and describes the impact as letting an attacker “bypass security controls to access, control, or disrupt affected Baseboard Management Controllers (BMCs), which may enable lateral movement or persistence across managed enterprise infrastructure.”

What this means for you

Start with the question that has a yes or no answer: is any BMC you own reachable from the internet? If the answer is yes, that’s the incident, and it outranks every unpatched CVE on the list. runZero’s own remediation advice is to restrict management access to trusted IP ranges or internal subnets, isolate the interface from the public internet wherever possible, and where that isn’t practical put it behind a VPN or a dedicated management network with separate monitoring. None of that needs a vendor patch.

Three moves cost nothing but a maintenance window:

• Block UDP 623 and the BMC web ports at the network edge, then verify from outside rather than trusting the firewall config.
• Rotate every factory-set BMC password at provisioning time, because the chassis-label defaults are a known keyspace.
• Turn IPMI-over-LAN off where Redfish already covers what your tooling needs, since HPE told Lava that newer generations ship it disabled by default.

Moore also released OOBscan, an open-source scanner that fingerprints BMCs, IP-KVMs, PDUs and serial servers across 13-plus protocols and flags pre-auth leaks, default credentials and known-vulnerable firmware. The deep checks are deliberately held back: the repository calls itself a pre-release “missing detailed checks for vulnerabilities still going through the vendor notification and disclosure process.” The concession running through all of this, from unverified BMC firmware to AMD walking back consumer memory encryption, is that the layers below the OS were never built to be defended.

So watch two numbers. The first is how quickly HPE, Dell and Supermicro turn those pending disclosures into shipped firmware. The second is that 75,000. A flaw published in 2013 still owns tens of thousands of internet-facing servers in 2026, and if that figure hasn’t moved by next August, the patch pipeline is the story rather than the bugs.