24,650 Exposed BMCs and a Decade-Old Bug Nobody Patched
Your OS reinstall didn't fix anything. That's the uncomfortable truth buried in this week's disclosure about Baseboard Management Controller vulnerabilities, and it's the kind of finding that should make every infra team's stomach drop.
Here's what happened: researchers presented a new set of BMC flaws at a security conference, affecting thousands of Internet-connected servers from the world's biggest manufacturers. Some of these bugs are more than a decade old. Not months. Not years. Decades. That's how long a critical vulnerability sat in motherboard firmware, unnoticed or unaddressed, while the entire industry kept shipping new servers on top of it.
If you're unfamiliar with BMCs, think of them as a tiny computer living inside your computer — a dedicated microcontroller that manages power, health monitoring, and remote administration even when the main OS is completely offline. That's the whole point of them. It's also exactly why compromising one is so devastating.
The Real Story
Everyone's going to focus on the headline vulnerability count. The real story is what this reveals about how deep the rot goes across the entire server ecosystem.
This isn't an isolated incident. A July 29 report — separate from this disclosure but part of the same pattern — found 24,650 exposed BMC endpoints leaking password-derived authentication material through a long-standing IPMI flaw. Of those:
- 6,240 accepted empty usernames and weak passwords
- 2,340 used default accounts like
ADMINorrootwith laughably common passwords
And here's the part that should really worry you: researchers found evidence of possible real-world exploitation while just scanning these exposed endpoints. Not theoretical. Happening.
This follows years of similar findings. Eclypsium previously flagged motherboard firmware issues across Lenovo, Acer, AMAX, Bigtera, Ciara, Penguin Computing, and sysGen — where attackers with host admin access could persistently rewrite BMC flash contents. Then there was the Gigabyte firmware saga, where hundreds of motherboard models shipped with backdoor-like functionality that potentially affected millions of systems. Researchers said it looked intentional enough that removing it would require a firmware update, not a simple config change.
<> Compromise below the OS layer means reimaging your server doesn't remove persistence. Your monitoring stack, your EDR, your incident response playbook — none of it sees the BMC./>
That single fact should reframe how every platform engineer thinks about server trust. OS hardening alone is insufficient. If your threat model stops at the kernel, you've already lost.
Why does this keep happening? Because the BMC ecosystem is smaller and more fragile than people realize. Most OEM server brands are reusing the same handful of firmware stacks — AMI MegaRAC, OpenBMC, and vendor-specific variants — across wildly different product lines. One bad flaw in a shared component doesn't just hit one vendor. It cascades across the industry.
I keep coming back to the 2018 Supermicro/Bloomberg controversy here. That story was about alleged implanted hardware, and it created lasting paranoia about server supply chains. What we're seeing now is arguably worse — it's not speculative, it's demonstrated, repeatable, and it's been hiding in plain sight for ten-plus years.
If you operate infrastructure, the fix isn't glamorous but it's non-negotiable:
1. Inventory every BMC firmware version in your fleet
2. Pull management interfaces off the public Internet immediately
3. Segment BMC networks like they're radioactive
4. Treat firmware patching with the same urgency as OS patching — because right now, most organizations don't
Firmware transparency shouldn't be a competitive advantage vendors brag about. It should be table stakes. Until it is, buy from whoever actually publishes security advisories — and audit the rest.
