Black Hat researchers warn BMC flaws can backdoor thousands of servers

Security researchers say thousands of internet-connected servers can be persistently backdoored through flaws in baseboard management controllers, according to Ars Technica’s reporting from the Black Hat conference in Las Vegas. The weaknesses sit in BMC firmware used for “out-of-band” administration—interfaces designed to stay reachable even when a machine is powered down or the main operating system is broken. RunZero founder HD Moore told attendees he has identified more than a dozen new issues across BMC ecosystems used by major server vendors.

BMCs are meant to be the last-resort handle for administrators: reboot a frozen server, reinstall an operating system, apply updates, and check hardware health without walking into the datacenter. That same design makes them a high-value target. A compromised BMC can survive disk wipes, see traffic before the host does, and act as a staging point to move laterally inside corporate networks. Researchers have warned for more than a decade that BMCs are often treated as plumbing—deployed everywhere, rarely monitored, and patched slowly because updates can be operationally risky.

Moore’s scans, as described by Ars Technica, found large numbers of BMCs reachable from the public internet, with a majority of those exposures carrying at least one critical vulnerability. A second scan inside corporate networks also found a substantial share of BMCs with critical issues, suggesting the problem is not just careless perimeter configuration but routine internal practice. Some of the most consequential weaknesses relate to IPMI, the management protocol that allows BMCs to operate independently of the host system. One long-known IPMI authentication weakness can enable offline password cracking, turning a captured handshake into a reusable administrative credential.

The new findings also point to failure modes that are hard to mitigate with policy alone. If a management interface accepts unsigned or unencrypted commands in sessions that are supposed to be protected, network segmentation becomes a partial defense rather than a fix. And because BMCs ship as embedded computers with their own operating systems and network stacks, patching depends on a chain of vendors—chip providers, firmware projects, server manufacturers, and enterprise customers—each with reasons to delay changes that might brick hardware or trigger downtime.

Moore is withholding technical details until vendors can patch, Ars Technica reports, but the broad picture is already concrete: the “lights out” layer that keeps fleets running is still widely exposed and widely vulnerable. The same interfaces that let administrators recover servers when everything else fails are also the ones attackers only need to reach once.