24,000 EXPOSED SERVERS LEAK PASSWORD HASHES VIA 20-YEAR-OLD BMC FLAW

Baseboard Management Controllers are out-of-band management interfaces that let administrators access servers remotely, even when the main operating system is offline. The vulnerability affects multiple BMC implementations and has persisted unpatched for approximately 20 years. Exposed BMC interfaces are particularly dangerous because they operate independently of standard server security measures. Attackers scanning for vulnerable devices can extract password hashes and potentially crack them to gain administrative access to critical infrastructure. The widespread exposure suggests many organizations have failed to restrict BMC access to trusted networks or change default credentials. Security researchers recommend immediately inventorying BMC devices, restricting network access to administrative ranges only, and applying available patches. Organizations should treat BMC security as critical infrastructure protection rather than an afterthought, given attackers' ability to bypass standard server defenses through these interfaces.