Thousands of servers can be backdoored by exploiting buggy motherboard controllers
Security researcher HD Moore has revealed that thousands of Internet-connected servers from major manufacturers, including HPE, Supermicro, Huawei, Lenovo and Dell, can be remotely compromised through critical vulnerabilities in baseboard management controllers (BMCs), the small independent computers embedded in server motherboards. Presented at the Black Hat security conference in Las Vegas, the research shows that flaws first warned about in 2013 remain widespread and largely unpatched, creating what Moore describes as a "pervasive, under-monitored" attack surface that gives hackers a route to persistent, deep access into datacentres even when the servers themselves are switched off.
BMCs allow administrators to manage fleets of servers remotely, including rebooting machines and reinstalling operating systems, but their IPMI protocol has long been a weak point. Moore's scans found more than 86,000 Internet-exposed BMCs, over 54% of which carried at least one critical vulnerability, while up to 75,000 remained open to a decade-old password-cracking flaw (CVE-2013-4786). A separate internal scan of over 126,000 BMCs on corporate networks found nearly 29% affected by critical bugs, and Moore says he has also uncovered more than a dozen new vulnerabilities, details of which are being withheld until manufacturers can issue fixes.
In short
- Critical, often decade-old bugs in server BMCs allow remote backdoor access.
- Over 54% of 86,000 exposed BMCs online carry critical vulnerabilities.
- Researcher found new flaws too, kept secret pending vendor patches.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The security research community and enterprises need transparent understanding of infrastructure risks; these vulnerabilities have existed for over a decade without adequate patching, demonstrating that vendors lack sufficient incentive to act. Moore's public disclosure at Black Hat, whilst withholding details of newly discovered flaws, creates necessary pressure for remediation and accountability. Staged, responsible disclosure that reveals the scale of the problem—without enabling immediate exploitation—drives systemic improvement across the industry.
The case against
Public disclosure of unpatched vulnerabilities affecting 86,000+ exposed systems immediately weaponises the findings for malicious actors, particularly given BMCs' critical role in maintaining access even when servers are offline. Many organisations cannot patch instantaneously, leaving known attack surfaces publicly documented. Vendors should have received longer, stricter confidentiality periods before a global presentation at a major security conference, allowing coordinated patching windows rather than guaranteeing rapid exploitation of documented vulnerabilities.
Explained simply
Servers use small controllers on their motherboards, known as baseboard management controllers, to let administrators manage them remotely. These controllers can restart a server or reinstall its software, even when the main computer is switched off.
The system relies on a protocol called IPMI, and weaknesses in it have been known about for years. Security researcher HD Moore has found that many controllers remain exposed or unpatched, including on equipment made by several major manufacturers.
A vulnerable controller could give an attacker lasting access to a server and the wider datacentre it serves. This matters because these systems are used to manage large groups of computers, while their separate connection can make them harder to spot and secure.