A 13-year-old flaw is exposing tens of thousands of data center management systems

The ‘no man’s land’ beneath the OS on enterprise servers is becoming the malicious actors’ next target.

Attackers are gaining a foothold into broader data center environments by exploiting Baseboard Management Controllers (BMCs) that are largely unprotected, still running decades-old protocols and susceptible to a vulnerability published 13 years ago, according to data center security company Lava.

Lava’s red team researchers were able to hack into BMCs, which provide out-of-band remote control over servers without the need for physical access, within minutes by guessing basic passwords. BMCs on Supermicro and HPE servers were among the most impacted.

“BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage,” Michael Katchinskiy, Lava’s head of security research, explained in a blog post. “Most security tools monitor the operating system, kernel, containers, and workloads.”

But BMCs operate outside that trust boundary, he said, “giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.”

How attackers can exploit BMC weaknesses

As the name ‘baseboard’ would imply, BMCs are specialized micro-controllers embedded in server platforms that operate independently of the host system’s main CPU, memory, and operating system (OS). This gives admins the ability to do out-of-band management and troubleshooting of servers, update firmware, change configurations, and read hardware sensors, among other actions.

“In practice, the BMC is one of the most privileged control points in a data center,” Katchinskiy noted.

But BMCs can expose management planes such as the 22-year-old out-of-band IPMI, the newer HTTPS-based Redfish, browser-based admin interfaces, and remote console features. In many cases, these share the same database and even the same credentials.

The culprit enabling the current attacks is a vulnerability in the IPMI 2.0 authentication…