The little computer that owns everything

Inside nearly every server, soldered right onto the motherboard, sits a tiny computer you never directly use. It has its own processor, its own memory, its own network port. It stays powered on even when the main server is shut down. It can turn the server on and off, watch the screen, capture keystrokes, and rewrite the firmware the server boots from.

This is a Baseboard Management Controller. BMC for short.

Think of your server as an apartment building and the BMC as the superintendent who lives in the basement. The super has a key to every apartment, controls the boiler, and answers the phone 24/7. They don’t care whether any tenants are home. They just take orders and do things.

Now, more concretely: if you’ve ever rebooted a server remotely, mounted a virtual disk from halfway across the world, or watched a console feed while the OS was still waking up, you were talking to the BMC. It runs even when the server is powered down. It sees the keyboard and the screen before anything else does. It can rewrite the firmware your server boots from. It operates at a privilege level that makes root look like a guest pass.

The protocol most BMCs speak is called IPMI. A protocol is just an agreed-upon way for two computers to talk, a shared language. IPMI is the one BMCs use to take orders: power on, power off, show me the sensors, open a console, flash this firmware. IPMI is old. It was designed when the worst thing on a management network was a misconfigured switch, so it leans on assumptions that aged about as well as telnet over the open internet.

In August 2026, the worst of those assumptions got a public reckoning.

DEF CON 34

DEF CON is the annual gathering where security researchers drop the year’s most uncomfortable findings in front of a room full of people who know exactly how bad it is. Friendly crowd, sharp teeth. It has been running since 1993 and is where many of the vulnerabilities you hear about in mainstream news got their first public airing. Think of it as the place where the cybersecurity industry goes to say, out loud and on the record, “we found something you need to know about.”

Security researcher HD Moore, co-founder of runZero, has been tracking BMC security since Dan Farmer first showed in 2013 that IPMI would happily hand over password hashes to anyone who asked. At DEF CON 34, Moore walked back on stage with a number that says the problem didn’t just persist. It accelerated. His research found 123 confirmed vulnerabilities across eight vendors, consolidated into 35 draft advisories. Some of the affected devices are sitting behind a million dollars of GPU hardware and a web login page with no password required.

“These are devices that are effectively a sanctioned backdoor to whatever your real hardware is,” Moore told Network World’s Sean Michael Kerner. The word sanctioned matters. These aren’t exploits planted by an adversary. They’re features, shipped by vendors, sold in server catalogs, and left running for years after the buyer forgot they existed.

How a port ends up on the open internet

Most servers ship with a single physical network port shared between the host operating system and the BMC. When everything works, the BMC keeps to its own IP address on a separate VLAN and nobody outside the management network ever sees it. When something goes wrong, a configuration reset, a checksum error, someone DHCP-ing the wrong NIC, the BMC grabs its own address from whatever subnet the cable is plugged into. Suddenly a device designed for a locked-down management network is sitting on the production LAN. Or worse, on the public internet.

runZero’s internet-wide scans found about 51,000 devices responding to IPMI probes across the full IPv4 space. Roughly 23,000 to 25,000 of those handed over a crackable password hash with no authentication required at all. Just ask and you shall receive. The numbers get darker on internal networks, where nobody expected anyone to be scanning. Before Moore’s research, about 12% of BMCs on internal networks could be accessed without cracking anything. With the new vulnerabilities disclosed at DEF CON, that number hit roughly one in three. On internet-facing devices, the trivially exploitable share rose from 8% to 21%.

Once you’re in through the BMC, the server’s own defenses are irrelevant. “It doesn’t really matter how secure your server is,” Moore said. He wasn’t exaggerating. Several of the bugs start with zero credentials and end with code execution on the host, not just the management controller.

Here’s what the architecture should look like, and what it actually looks like:

CORRECT ARCHITECTURE:

┌─────────────────────────────────────────────┐
│                THE INTERNET                  │
└────────────────────┬────────────────────────┘
                     │
              ┌──────▼──────┐
              │  FIREWALL   │
              └──────┬──────┘
                     │
┌────────────────────▼────────────────────────┐
│           PRODUCTION NETWORK                │
│      (web servers, databases, apps)         │
└────────────────────┬────────────────────────┘
                     │
              ┌──────▼──────┐
              │  FIREWALL   │ ◄── management traffic
              └──────┬──────┘     stays behind this gate
                     │
┌────────────────────▼────────────────────────┐
│          MANAGEMENT NETWORK                 │
│    (BMCs, IPMI, iDRAC, iLO, PDUs)          │
│         ISOLATED. NO INTERNET.              │
└─────────────────────────────────────────────┘


WHAT ACTUALLY HAPPENS TOO OFTEN:

┌─────────────────────────────────────────────┐
│                THE INTERNET                  │
└────────────────────┬────────────────────────┘
                     │
              ┌──────▼──────┐
              │  FIREWALL   │
              └──────┬──────┘
                     │
┌────────────────────▼────────────────────────┐
│           PRODUCTION NETWORK                │
│                                             │
│  ┌────────┐  ┌──────────┐  ┌──────────┐   │
│  │WEB SVR │  │   BMC    │  │   BMC    │   │ ◄── THE BMCs ARE
│  │        │  │ (shared  │  │ (shared  │   │     ON THE SAME
│  │        │  │  port!)  │  │  port!)  │   │     NETWORK AS
│  └────────┘  └──────────┘  └──────────┘   │     PRODUCTION
└─────────────────────────────────────────────┘

The same bugs, the same code, everywhere

Moore’s research grouped the flaws into recurring classes that show up across vendors because the underlying protocols and codebases are shared.

Before the details, one concept worth understanding: pre-authentication. Authentication is proving who you are — you knock on the door and show your ID. Pre-authentication means before you even knock. A pre-authentication flaw is when the door opens because the lock itself is broken, before anyone checks who’s standing there. Moore found a stack of them.

RAKP, the authentication handshake IPMI 2.0 uses, has six defined steps. Skip or reorder them and the BMC can be confused into authenticating against leftover data from a previous, unrelated session. The state machine does not validate that you followed the sequence, so an attacker opens one session, captures a partial state, abandons it, opens a second, and injects the stale data to get in without credentials.

Type confusion is another recurring trick. Open a session in anonymous mode, and the BMC sometimes reuses credentials meant for a different mode because it stored authentication state globally instead of per-session. An anonymous channel inherits the privileges of an admin channel that happened to be open at the same time. Two sessions sharing the same identifier let a low-privilege account escalate to administrator the same way.

Some devices accept unencrypted commands even after both sides agreed on a cipher suite that was supposed to require encryption. The negotiation happens, encryption is selected, and then the BMC shrugs and executes plaintext commands anyway. Supermicro added a hardcoded password intended to stop hash leaks, and the fix itself became a bypass: anyone who knows the hardcoded value can present it during the handshake and skip the real credential check entirely.

Then there’s OpenBMC. This is the one to pay attention to, because it doesn’t stop at one vendor.

OpenBMC is the open-source firmware project that runs the BMC on Supermicro’s newest generation, Nvidia BlueField, Intel platforms, Google’s infrastructure, and other hyperscalers. It’s a shared Linux distribution for management controllers. When the code is shared, a bug in the authentication flow does not stay contained. It reaches every product built on that codebase at once.

The flaw Moore found is the kind that makes you stare at the screen for a second. An attacker can authenticate as any user by deliberately setting an invalid privilege level during the handshake. When the session sees the garbage privilege value, it can’t look up the real password. So it falls back on a default key that’s baked right into OpenBMC’s own source code, the same key on every device, instead of the password it was supposed to check. No cracking. No brute force. Just a deliberately malformed request and you’re in as whoever you want to be.

The other backdoors you forgot about

BMCs are the headliner, but Moore’s research lit up an entire layer of forgotten infrastructure. OOBscan doesn’t just scan for BMCs. It scans for everything that lives in the out-of-band management layer, because the same neglect applies to all of it.

Serial port servers are boxes that take old-style serial console cables and put them on the network, so you can reach a router’s command line from anywhere. They’re the answer to a problem nobody solved more gracefully: a lot of networking gear still exposes its deepest controls over a physical serial port, and someone needs to bridge that to IP. The problem is they run firmware that rarely sees updates and ship with default credentials nobody changed. A forgotten serial server in the back of a rack is the same class of risk as a forgotten BMC: an always-on, always-listening remote-control channel.

IP-KVMs are the internet-enabled version of the Keyboard-Video-Mouse switch. Plug one keyboard, monitor, and mouse into several servers, then control any of them through a web browser. You see the screen before the OS loads, BIOS and all. The risk mirrors the BMC risk exactly: a device with its own operating system and web interface, often years out of date, with factory credentials still in place. An attacker on an IP-KVM has everything an attacker on a BMC has.

PDUs — power distribution units — are the fancy power strips that fill a server rack. Managed PDUs have a network port so you can power-cycle individual outlets from your desk. They also run firmware nobody patches and sit on networks nobody audits. A compromised PDU can kill production servers at will, or serve as a stepping stone deeper into the management network.

These devices share a defining characteristic: they bypass the server’s own defenses completely. Out-of-band management means a separate path that works when the main path is broken. When the highway is closed, you take the back road. The back road has its own gates, its own locks, its own map. Too often, nobody checked whether the gates were locked.

Same engine, different car

This dynamic is not new, but the scale of it is. Shared codebases amplify the damage of a single bug across an entire industry. Even with proprietary firmware, vendors implement the same IPMI spec and reproduce the same RAKP mistakes, Moore found those bugs in HPE iLO and Dell iDRAC running fully proprietary stacks. The protocol itself is the shared attack surface. OpenBMC adds a second, deeper layer: when authentication logic lives in one codebase that every vendor pulls from, a single flaw reaches every product at once. That’s not just Intel’s problem. It’s Nvidia’s and Google’s and Supermicro’s and every colocation provider who racked a server and forgot the BMC had an IP address.

The protocol layer has the same problem. IPMI 2.0 is an industry standard. Vendors implement the same spec, and they implement the same mistakes. RAKP authentication is broken in the standard, not just in one vendor’s reading of it, so the bugs propagate by design. The state machine behind the handshake has holes that every implementer has to independently notice and patch, and the DEF CON presentation made clear that most of them haven’t.

This should feel familiar. It’s the same story as the early web, when everyone ran the same Apache build and one remote code execution bug lit up half the internet. Or the router era, when a handful of chipsets meant a vulnerability in one brand was a vulnerability in all of them. The vehicle changes. The physics don’t.

What runZero put in your hands

Alongside the disclosure, runZero released OOBscan, an open-source scanner that automates the bypass techniques Moore presented. Think of enumeration as walking through a dark warehouse with a flashlight, calling out, and writing down everything that answers — that’s what OOBscan does. It finds BMCs, serial-port servers, IP-KVMs, power distribution units, and a list of other management surfaces most organizations don’t know they have exposed. It checks for protocol-level exposures, pre-authentication information leaks, default credentials, and known-vulnerable firmware. The IPMI coverage is enabled by default and drives the research Moore presented.

The tool is a single static Go binary with no runtime dependencies. Point it at a network and it handles discovery, fingerprinting, vulnerability checks, and credential recovery in one pipeline. The RAKP hash cracking runs offline, so there’s no account lockout risk. It also speaks Redfish, SSH, SNMP, WS-Management, and Intel AMT, reaching the protocols that have partially replaced IPMI without fully retiring it.

Moore summed up the state of things with the bluntness you’d expect from someone who just spent a year proving the industry moved backwards: “From our perspective, we kind of won. The majority of IPMI devices in the world now, you can go from zero to full authentication to take over the boot process to then take over the host OS.”

What to do now

The fixes are not complicated. The problem is that they require someone to do them.

Segment management traffic onto its own VLAN

Put every BMC, serial server, IP-KVM, and PDU on a dedicated management VLAN — a VLAN is a virtual network segment that keeps traffic separate even when devices share the same physical switch. Pre-authentication flaws cannot reach past a network segment the attacker is not on. If your management VLAN is reachable from your guest Wi-Fi, it is not a separate VLAN. Firewall rules must default to deny and allow only specific source IPs for administrative access.

Use a dedicated management NIC

A physical network port shared between the host and the BMC via NCSI — the sideband interface that lets two devices share one cable — puts the BMC on the same switch port and access list as production traffic. A configuration reset on Tuesday becomes a breach on Wednesday because the BMC grabs an address via DHCP, the automatic IP-assignment protocol, on the wrong subnet. Use a separate physical port for the BMC, cabled to a management-only switch, with no route to the production network or the internet. Cable color matters here: make it visibly distinct from production cabling so nobody accidentally repatches it.

Disable KCS unless you specifically require it

KCS, Keyboard Controller Style, is an in-band channel that lets the host operating system talk to its own BMC using IPMI commands with no separate credentials. It exists so the OS can read sensors and log events. It also means anyone who gets root on the host gets the BMC immediately, because KCS requires no additional authentication. Disable it in the BIOS or BMC configuration unless you have a specific, documented operational need. If root on the host equals admin on the BMC, you have removed the only isolation layer that makes out-of-band management a separate trust boundary.

Set unique credentials on every device

Moore found that roughly 8% of internet-facing BMCs were accessible with zero effort before his new research, and 21% after. On internal networks, one in three. The fastest path to a leaked RAKP hash is a shared or default password. The crack is offline, silent, and nearly instant against a known default. Every BMC, serial server, IP-KVM, and PDU needs a credential that is not shared with any other device and not present in any vendor’s default list.

Replace IPMI with Redfish where possible, and enforce it at the network level

Redfish is the modern replacement for IPMI. Where IPMI uses a custom UDP-based protocol that dates back to 2001, Redfish uses the same HTTPS your browser uses, with data formatted as JSON instead of obscure binary packets. This removes a large share of the attack surface simply by eliminating the RAKP handshake and the IPMI 1.5 plaintext fallback. Turning off IPMI should be done at the network level, not just in the management interface, so no configuration reset, BIOS default, or firmware rollback can undo the change. If UDP port 623 — the port IPMI listens on — is not filtered at the switch, a BMC that resets to factory defaults will be speaking IPMI again within minutes.

Scan for what you do not know you have

Run OOBscan across your internal networks. The devices it finds are the ones that shipped with servers five years ago and have been listening quietly ever since. Nobody remembers deploying them. Nobody patched them. Nobody changed the password. They are the sanctioned backdoors, and the tool to find them is free, open-source, and written by the researcher who just disclosed the vulnerabilities. Run it before someone else does.

HD Moore didn’t discover a new class of threat. He proved that a known threat got worse while the industry looked the other way. The tools exist. The fixes are understood. The only thing missing is the decision to treat the little computer inside the server with the same paranoia as the server itself.

That little computer is still listening. It shipped with the server, it’s been online since the day it was racked, and it will answer anyone who knows how to ask. The question is whether you ask it first.

References: DEF CON; OOBscan, runZero; Out of band, out of mind: DEF CON research calls IPMI a ‘sanctioned backdoor’ into enterprise networks, Network World.