Critical BMC flaws let attackers backdoor thousands of major-brand servers

New research presented at the Black Hat security conference in Las Vegas shows that critical vulnerabilities persist in the baseboard management controllers (BMCs) embedded in enterprise servers from the world’s largest manufacturers. HD Moore, founder of runZero, identified more than twelve fresh flaws across products from HPE, Supermicro, Avocent, Huawei, Lenovo, Dell and additional vendors, which can be exploited to gain remote code execution and install persistent backdoors.

BMCs operate with their own operating system, network stack and IP address, providing out-of-band management even when the host server is offline. Since at least 2013, security analysts have warned that the IPMI one outlet used by BMCs creates a “golden” attack surface, yet many of the earlier issues remain unaddressed. The findings underscore a largely unmonitored and under-patched parallel attack vector that could compromise large data-center fleets.