2. A failure of IPMI to enforce integrity and encryption protections in-session. “The device decides whether to authenticate and decrypt each packet from that attacker’s own header, and not from the algorithms the session negotiated, so an unsigned, unencrypted command is accepted on a secured session,” Moore said. A proof-of-concept exploit Moore developed uses such bugs to “chain otherwise-unexploitable issues into full sessions.” Affected vendors include HPE, Supermicro, and Intel (legacy).

3. Predictable session identifiers. Session tokens are generated from counters or from a clock rather than secure random sources. This allows an attacker to predict and take over another user’s live BMC session across both the IPMI service and browser-based KVM consoles. The two most significant bugs are both present in Supermicro systems.

4. Pre-authentication memory corruptions. A length-validation error in the management SSH service is reachable before authentication and can be driven to execute malicious code. Moore found the vulnerabilities in HPE iLO systems.

5. The existence of unsigned or attacker-controllable firmware and unenforced configuration integrity. An authenticated administrator can install a persistent implant or replace the key used to verify firmware. These can be chained to separate authentication bypasses and privilege escalation vulnerabilities. Affected vendors include Supermicro, H3C, and Dell.

6. The use of secrets recoverable from firmware as live credentials. Keys and constants that can be extracted from public firmware can be used to authenticate to, or decrypt traffic from, BMCs. Affected vendors include Supermicro, OpenBMC, Huawei, and Dell.

7. Default and factory-random credentials that can be compromised by hash disclosure made possible through CVE-2013-4786. Frequently, devices continue to use default credentials. Even when the credentials have been changed before shipping, the small keyspaces of factory-randomized passwords make them recoverable in offline cracking attacks. Affected vendors include HPE, Supermicro, and Dell. HPE was the worst (eight digits or alphanum), and Supermicro and Dell use slightly longer defaults, which increase the cost of the attack and may delay the cleartext recovery by hours or days, depending on available compute.

https://arstechnica.com/security/2026/08/thousands-of-servers-can-be-backdoored-by-exploiting-buggy-motherboard-controllers/