How Researchers Reached Thousands of Data Centers in Minutes via a 20-Year-Old IPMI Flaw
AccBalanced · x · 2026-09-03
Lava researchers show how a 20-year-old vulnerability let them reach bare-metal servers across thousands of data centers: of 36,872 internet-exposed IPMI interfaces, 24,650 leak password-derived hashes pre-auth due to CVE-2013-4786, and over 30% of recovered passwords fell to common wordlists or predictable factory-sticker formats. A BMC grants control independent of the OS — one exposed controller can risk an entire GPU fleet. SemiAnalysis' Jordan Nanos adds that neoclouds serving banks, telcos, and national defense are years out of date with no patching or customer-notification processes. The team released the BMCRadar exposure map and the FORGE security framework.
More from Infra
- RunInfra launches $10/mo coding plan: fastest open models across 19 agents incl. Claude Code — ycombinator · 2026-10-21
- OVHcloud Chief Gives Interview on the Company's AI Strategy — JiliJeanlouis · 2026-10-21
- Kimi K3 hits 391 tokens/s per user on TPU v7 with open-source vLLM megakernels — woosuk_k · 2026-10-21
- DeepSeek open-sources DeepInfer inference framework powering V4.1-Flash — kingslyj · 2026-10-21
- TPN Bench launches quantization service: I-matrix and quant-aware distillation for any HF model — const_reborn · 2026-10-21
- Turso unveils MVCC implementation to lift SQLite's single-writer bottleneck — glcst · 2026-10-21