IPMI BMC Interfaces Leak Password Hashes, Exposing 24,650 Servers to Offline Cracking
What Happened — Researchers identified 24,650 publicly reachable Baseboard Management Controllers (BMCs) that were unintentionally disclosing IPMI password hashes. The exposed hashes can be downloaded and cracked offline, giving an attacker the ability to obtain clear‑text credentials for the underlying servers.
Why It Matters for Compliance & Audit Readiness
- The scenario directly tests SOC 2 CC6.1 (Logical Access) and CC6.2 (User Management) controls – you must prove that privileged credentials are protected, rotated, and that access to management interfaces is tightly restricted.
- Continuous‑monitoring of BMC exposure provides audit‑ready evidence that you are actively managing a known high‑risk attack surface.
- Demonstrating remediation (network segmentation, password rotation, MFA) supplies defensible documentation for a SOC 2 audit and for third‑party risk assessments.
Who Is Affected — Cloud‑hosting providers, colocation data‑center operators, enterprises with on‑premise server farms, and any organization that relies on IPMI for out‑of‑band management.
Recommended Actions
- Inventory all BMC/IPMI endpoints and verify they are not exposed to the public Internet.
- Enforce network segmentation or firewall rules that limit BMC access to trusted management subnets only.
- Rotate all default or weak IPMI passwords and enforce strong, unique credentials.
- Deploy multi‑factor authentication or certificate‑based access where supported.
- Integrate BMC access logs into your SIEM and map them to SOC 2 CC6.1 evidence collection.
Source: HackRead
Technical Notes — The flaw stems from the IPMI protocol’s handling of authentication data; BMC firmware inadvertently returns password hash values when queried over an unauthenticated HTTP/HTTPS endpoint. No specific CVE was assigned, but the exposure is a misconfiguration that enables offline password cracking. Source: HackRead