Flaw From 2002 Exposes Data Centers to Server Takeover

A 2002 vulnerability in the IPMI 2.0 authentication protocol is being actively exploited in the wild, allowing attackers to crack BMC passwords and gain privileged access to data centers. Researchers at Lava discovered that 24,650 BMC endpoints were exposing password-derived authentication material, with evidence of attacks targeting a major automotive component manufacturer and displaying ransomware notes. Due to the BMC's privileged access outside the OS, conventional security tools are largely ineffective, requiring a layered approach including network segmentation, credential changes, and disabling insecure features.