Every enterprise server ships with a second computer hidden on its motherboard. The baseboard management controller, or BMC, runs its own processor and firmware, maintains its own network interface and IP address, and keeps working even when the host is powered off or its operating system has crashed. That independence makes it an ideal remote-management tool and, as research presented this week at Black Hat USA demonstrates, an ideal backdoor.
runZero, the security firm founded by Metasploit creator HD Moore, scanned the public internet and found more than 86,000 BMCs reachable from outside a network. More than half of them, over 54 percent, carried at least one critical vulnerability. A parallel scan of 126,761 BMCs on corporate networks found nearly 29 percent critically vulnerable, an attack surface that Moore argued is barely monitored inside most enterprises.
In a Black Hat briefing on August 5, Moore disclosed more than a dozen previously unknown flaws spread across the management controllers of Dell, HPE, Supermicro, Fujitsu, H3C, AMI, and the open-source OpenBMC project, among others. The findings are also scheduled for a presentation at DEF CON later in the week, and runZero says technical details of individual CVEs will be published as coordinated disclosures conclude.
What makes the findings uncomfortable is their age. Roughly 75,000 of the exposed systems remain vulnerable to CVE-2013-4786, a flaw in the authentication protocol of IPMI 2.0 that lets an attacker crack administrator passwords offline. The protocol’s problems are not news: security researcher Dan Farmer documented severe architectural weaknesses in IPMI back in 2013, including authentication bypasses and password hash disclosure, and Moore himself was warning about this class of problem more than a decade ago. Portions of those warnings are still live.
The newly disclosed flaws fall into familiar categories: authentication bypasses in IPMI implementations, predictable session identifiers, weak controls over encrypted sessions, flaws in SSH management services that are reachable before authentication, weak firmware tamper protection from some vendors, and cryptographic keys extractable from publicly downloadable firmware images. Many can be chained: a foothold won through one weakness can be traded up through additional flaws until the attacker holds permanent control of the BMC, which in turn enables lateral movement and persistence across the data center. runZero describes the practical impact as a bypass of network segmentation.
The defenses are straightforward, if routinely ignored. Management interfaces should not be exposed to the public internet; where they must be reachable, access should be limited to trusted subnets or a VPN, with monitoring on whatever paths remain. runZero also released OOBscan, an open-source tool for locating vulnerable BMCs and IPMI configurations, and recommends a structured firmware patching program covering every vendor. Until then, the hidden second computer in the rack remains a standing invitation.
Sources: Thousands of servers can be backdoored by exploiting buggy motherboard controllers (Ars Technica, Aug 5, 2026); BMC vulnerabilities (Lights Out), runZero Research (runZero, Aug 5, 2026); Thousands of servers at risk due to old BMC vulnerabilities (Techzine, Aug 6, 2026)