24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

Cybersecurity researchers have discovered a large number of Baseboard Management Controller management interfaces exposed to the public internet, with over 36,000 instances found to be running the Intelligent Platform Management Interface protocol. Of these, more than 24,000 disclose password-derived authentication hashes before login. This vulnerability is due to the exposure of IPMI protocol to the public internet. The exposed interfaces can potentially be accessed by unauthorized parties. The researchers have raised an alert regarding this issue, which affects a significant number of server-management interfaces. The exposed password hashes can be used to gain unauthorized access to the systems.