How Researchers Reached Thousands of Data Centers in Minutes via a 20-Year-Old IPMI Flaw
AccBalanced · x · 2026-09-03
Lava researchers show how a 20-year-old vulnerability let them reach bare-metal servers across thousands of data centers: of 36,872 internet-exposed IPMI interfaces, 24,650 leak password-derived hashes pre-auth due to CVE-2013-4786, and over 30% of recovered passwords fell to common wordlists or predictable factory-sticker formats. A BMC grants control independent of the OS — one exposed controller can risk an entire GPU fleet. SemiAnalysis' Jordan Nanos adds that neoclouds serving banks, telcos, and national defense are years out of date with no patching or customer-notification processes. The team released the BMCRadar exposure map and the FORGE security framework.
More from Infra
- Developer Moves AI Agents to a Dedicated Linux Workstation Using Incus System Containers — kevinkern · 2026-10-21
- Nvidia guides 70% growth citing unmet AI demand, while media panics over a $500M Korean neocloud IPO — firstadopter · 2026-10-21
- Pichai: everyone is massively short on AI compute — 'everyone wishes you had two times what you had planned' — firstadopter · 2026-10-21
- Stanford CS336 Lecture 6: fused Triton kernels cut softmax memory traffic ~4x — stanfordnlp · 2026-10-21
- General Compute partners with Positron AI: Atlas memory-centric hardware ships Q1 2027 — aftahi_ai · 2026-10-21
- AI bond issuance hits $419B in 2026, up 90% from all of 2025 — SumitGup · 2026-10-21