24,650 Internet‑Exposed BMCs Leak IPMI Password Hashes Prior to Login
What Happened — Researchers scanning the public IPv4 space identified 36,872 server‑management interfaces that expose the Intelligent Platform Management Interface (IPMI) protocol. Of those, 24,650 Baseboard Management Controllers (BMCs) return password‑derived authentication hashes before a login attempt, effectively leaking credential material to any unauthenticated observer.
Why It Matters for Compliance & Audit Readiness
- This is a classic control‑gap scenario that SOC 2’s CC6.1 – Configuration Management and CC7.1 – Logical Access Controls are designed to prevent and evidence.
- Continuous monitoring of configuration drift and automated evidence collection can prove you’ve remedied the exposure before an audit.
- Mapping this finding to your Trust Center demonstrates due‑diligence to auditors and customers alike.
Who Is Affected – Cloud‑infrastructure providers, data‑center operators, and any organization that runs on‑premise servers with BMC/IPMI management interfaces (e.g., finance, SaaS, telecom).
Recommended Actions
- Inventory all BMC/IPMI endpoints and block external access at the network perimeter.
- Apply vendor‑supplied firmware updates that harden IPMI authentication and disable hash disclosure.
- Enable continuous configuration monitoring and log collection for BMC management traffic; map findings to SOC 2 CC6.1/CC7.1 controls.
- Document remediation steps and retain evidence in a centralized Trust Center for audit readiness.
Technical Notes – The exposure stems from a default IPMI implementation that returns a salted SHA‑1 hash of the password during the “Get Device ID” command. No CVE is currently assigned; the issue is a misconfiguration rather than a software flaw. Affected data includes password hashes that can be cracked offline, leading to potential full BMC compromise. Source: The Hacker News