A security flaw discovered in baseboard management controllers (BMCs) has left more than 24,000 servers exposed, according to a report from German news outlet Golem. The vulnerability, which is roughly 20 years old, allows attackers to read password hashes from affected systems.
Golem reports that the flaw resides in the BMC firmware, a component used for remote management of servers. The issue enables unauthorized extraction of password hashes, which could then be cracked offline to gain administrative access. The outlet did not specify the exact manufacturer or model of the affected BMCs, but noted that the vulnerability has persisted for two decades without being patched.
The scale of the exposure is significant, with over 24,000 servers identified as vulnerable. Golem’s report highlights that this number may represent only a fraction of the total at risk, as many organizations may not have updated their BMC firmware. The flaw underscores the challenge of securing long-lived hardware components that are often overlooked in routine security maintenance.
Security researchers typically recommend that organizations audit their BMC configurations and apply any available firmware updates. In this case, Golem’s findings suggest that a substantial number of systems remain unpatched, leaving them open to potential compromise.
Watch for further disclosures from security researchers detailing the specific BMC models affected and any available mitigations.
