If you run enterprise servers — in a data centre, a cloud environment, or an on-premise server room — there is a very good chance that a small, largely overlooked chip embedded in your motherboard is quietly putting your entire infrastructure at risk. Baseboard Management Controllers (BMCs) are the silent workhorses of server administration. They are also, right now, one of the most actively targeted and persistently unpatched attack surfaces in the enterprise world. This isn't a niche concern for firmware enthusiasts. It is a board-level crisis that security teams, IT managers, and CISOs need to understand and act on immediately.

What Is a BMC — and Why Should You Care?

Baseboard Management Controllers are small computers built into nearly every enterprise server. They have their own firmware, operating system, network stack, and IP address — and administrators use them to reboot machines, install updates, reinstall operating systems, and monitor hardware, even when the main server is powered off or unresponsive.

That last point is critical.

BMCs provide what's known as "lights out" and "out-of-band" management because they work even when the servers they're attached to are turned off or unresponsive.

For IT teams managing large-scale infrastructure, this is enormously valuable. For attackers, it is a dream target.

That deep level of control makes BMCs valuable for IT operations — but dangerous if attackers gain access. If compromised, a BMC can give an attacker control over the underlying server.

And crucially,

BMC firmware is highly privileged, executes outside the scope of operating system controls, and has access to all resources of the server-class platform on which it resides — meaning that a compromised BMC can provide attackers with persistent, stealthy access that traditional security tools cannot detect or prevent.

The Scale of the Problem: Thousands of Servers Already Exposed

The numbers are alarming.

An external scan found more than 86,000 BMCs with management services exposed to the public internet — and more than half of them (54%) had at least one critical vulnerability.

That research was presented by firmware security expert HD Moore, CEO of runZero, at the Black Hat security conference in Las Vegas.

Inside corporate networks, the picture is barely better.

An internal scan of 126,761 BMCs found that nearly 29% contained one or more critical vulnerabilities.

As Moore himself noted,

the end result is "a widespread attack surface — both on the public Internet and within corporate environments — that remains under-monitored and poorly patched."

One of the most troubling findings relates not to newly discovered flaws but to ancient ones.

As many as 75,000 BMCs remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows attackers to crack administrator passwords offline

— a vulnerability that has been publicly known for over a decade.

CVE-2024-54085: The Maximum-Severity Flaw That Shook the Industry

While legacy flaws are a persistent headache, a more recent discovery sent shockwaves through the security community.

A critical security vulnerability was disclosed in AMI's MegaRAC Baseboard Management Controller (BMC) software — tracked as CVE-2024-54085 — carrying a CVSS v4 score of 10.0, indicating maximum severity.

CVE-2024-54085 is classified as an "Authentication Bypass by Spoofing" flaw.

In practice, this is as bad as it gets.

A proof-of-concept exploit can effectively create a service account for the Redfish management console, allowing unauthenticated access to all remote BMC features.

Major server manufacturers such as HPE, Lenovo, and ASUS use the MegaRAC BMC — meaning many servers in data centres, as well as those in companies with their own server farms, are at risk.

Then, in a historic moment,

CISA publicly acknowledged that these critical, foundational components are being exploited in the wild — marking the first time CISA added a Baseboard Management Controller vulnerability to its Known Exploited Vulnerabilities catalog.

A Pattern of Broken Patches and New Vulnerabilities

If you thought vendors were on top of the problem, the evidence suggests otherwise.

The vulnerabilities emerged following an investigation into supposedly fixed security issues, revealing that vendor patches implemented in January 2025 were insufficient to address the underlying authentication flaws.

Supermicro's BMC firmware has been particularly affected by this cycle.

CVE-2025-7937 is a weakness affecting the firmware validation logic used to secure Supermicro's BMC firmware — and attackers exploiting it would be able to update the system with rogue firmware.

Worse still,

Binarly discovered the issue when testing Supermicro's fix for a similar vulnerability, CVE-2024-10237, patched by the company in January

— meaning the fix itself opened a new door.

In either case, "this security issue could allow potential attackers to gain complete and persistent control of both the BMC system and the main server OS," said Binarly.

Other vulnerabilities exploit predictable session identifiers, insufficient controls on encrypted sessions, or flaws in the SSH management service that can be exploited even before authentication. Some vendors also do not adequately protect firmware against tampering or include cryptographic keys that can be extracted from publicly available firmware files.

Why BMC Attacks Are So Dangerous — and So Hard to Detect

The reason BMC vulnerabilities are so threatening goes beyond the initial compromise. It is what attackers can do after they get in.

A compromised BMC provides out-of-band management access, including remote power control, virtual console access, and the ability to mount virtual media — and most critically, attackers can install persistent firmware backdoors that survive OS reinstallation, evading standard incident response measures like reimaging or credential rotation.

That last point deserves emphasis: wiping and reinstalling the operating system will not remove a firmware-level backdoor.

Most security tools monitor the operating system, kernel, containers, and workloads — but the BMC operates outside that trust boundary, giving an attacker control beneath the host while remaining largely invisible to the tools designed to protect it.

The risks extend well beyond a single server.

In real-world settings, recovered credentials may work across multiple management interfaces within the same environment, and a single compromised BMC could serve as a pivot point to the broader management plane — and in AI environments with poorly segmented infrastructure, attackers could affect multiple tenants simultaneously.

APTs are increasingly targeting network edge devices and infrastructure components such as BMCs, granting them broader access, facilitating lateral movement, and providing opportunities for living off the land and ongoing espionage capabilities.

Practical Tips: How to Protect Your Servers Right Now

The threat is real and urgent, but it is not unmanageable. Here is what your team should do immediately:

Monitor BMC vendor advisories closely and establish a formal patching process across all deployed BMC vendors.

HPE and Lenovo have already issued patches for CVE-2024-54085 — check if your hardware is covered.

Restrict management access to trusted IP addresses or internal subnets, and isolate the interface from the public internet entirely wherever possible. If complete isolation is not feasible, ensure access is strictly limited to a secure VPN or dedicated management network.

The BMC's security is separate from the host OS — and even a fully patched and hardened OS cannot protect against a vulnerable BMC.

Lava's red team researchers were able to hack into BMCs within minutes by guessing basic passwords

— default or weak credentials remain one of the easiest entry points.

Detection requires BMC firmware integrity checks, a practice rarely performed in most organisations.

Schedule these as part of your standard security review cadence.

In many environments, BMC management networks lack effective segmentation, access controls, and monitoring

— a gap that attackers will readily exploit.

Create and regularly update an incident response plan that includes specific procedures for addressing vulnerabilities in BMCs, and ensure all relevant personnel are trained on the plan and understand their roles.

Conclusion: The Firmware Frontier Is the Next Battleground

BMC vulnerabilities represent a sobering lesson in the consequences of neglecting infrastructure security below the operating system level.

Researchers have warned since at least 2013 that BMCs present a golden opportunity for hackers looking for ways to gain deep and persistent access to data centres

— and yet, as the latest research proves, those warnings have largely gone unheeded. The CISA designation of CVE-2024-54085 as an actively exploited vulnerability is a watershed moment. It confirms what security researchers have been saying for years: firmware-level attacks are no longer theoretical.

The good news is that with the right posture — network isolation, aggressive patching, strong credential hygiene, and dedicated monitoring — organisations can dramatically reduce their BMC attack surface. The bad news is that doing nothing is no longer an option.

Is your server infrastructure protected at the firmware level? Don't wait for a breach to find out. Conduct a full BMC audit today, review your patch status against the latest vendor advisories, and isolate your management interfaces before an attacker exploits the gap. If you need help assessing your server security posture, speak to a specialist now — because below the operating system, your servers may already be under attack.