Legacy IPMI Protocol Weakness Exposes Data Center BMCs to Server Takeover

Exposing out-of-band server management interfaces directly to the public internet continues to present severe risk, as threat actors actively target a protocol design weakness dating back to the early 2000s. Baseboard Management Controllers (BMCs) running the Intelligent Platform Management Interface (IPMI) 2.0 specification allow unauthenticated remote users to obtain password hashes and perform offline password-cracking attacks.

The Protocol Weakness

IPMI 2.0 relies on the Remote Authenticated Key Exchange Protocol (RAKP) for authenticating remote management sessions. During the initial authentication handshake, the BMC returns a salted HMAC-SHA1 or HMAC-MD5 hash of the requested user’s password back to the client before verifying whether the client actually possesses the valid key.

Because the service returns this cryptographic challenge without authenticating the requester, an attacker only needs to send an initial RAKP message containing a valid username—such as common defaults like ADMIN or root. The attacker captures the returned HMAC response and attempts to crack the password offline using specialized cracking tools. Because the computation happens on the attacker’s local hardware, it bypasses network-level rate limits and account lockout mechanisms on the BMC.

Blast Radius and Data Center Risk

Baseboard Management Controllers operate independently of the host system’s CPU, hypervisor, and operating system, providing low-level hardware control over the network. If an adversary successfully cracks a BMC password, they gain complete out-of-band administrative access to the underlying server.

From this position, attackers can mount virtual media, modify system BIOS settings, reboot or power down hardware, reinstall operating systems, and monitor remote consoles. Crucially, access at the BMC level completely circumvents host-based endpoint detection and response (EDR) software, host firewalls, and operating-system-level multi-factor authentication. In enterprise data centers and cloud hosting environments, compromised management controllers provide adversaries with a persistent foothold to monitor bare-metal hosts or move laterally into management networks.

Remediating Management Controller Exposure

Because this vulnerability is inherent to the IPMI 2.0 protocol specification, firmware updates alone cannot eliminate the design flaw without disabling IPMI over LAN entirely. Organizations should take the following steps:

• Restrict Network Exposure: Ensure all BMC, Dell iDRAC, HPE iLO, and Supermicro management interfaces are completely removed from public internet exposure and placed on dedicated, isolated management VLANs.
• Require Zero-Trust Access: Restrict administrative access to management VLANs using encrypted VPNs, bastion hosts, or privileged access management (PAM) solutions.
• Disable Legacy IPMI: Disable IPMI-over-LAN services across all BMC interfaces where feasible, relying instead on modern RESTful APIs like Redfish over HTTPS.
• Enforce Complex Passwords: Assign long, complex, unique passwords to all BMC local accounts to render offline dictionary attacks computationally infeasible.