Old IPMI Flaw Leaves 24K Data‑Center BMCs Exposing Password Hashes
An IPMI 2.0 authentication bug (CVE‑2013‑4786), introduced in 2004, still powers roughly 37,000 internet‑exposed server‑management interfaces. Over 24,000 of those disclose password‑derived hashes before login, letting attackers recover weak or default credentials offline and gain privileged control of data‑center hardware.