Critical IPMI 2.0 Flaw Exposes Thousands of Servers to Pre-Authentication Attacks Security researchers have identified 36,872 internet-facing Baseboard Management Controllers (BMCs) running the IPMI 2.0 protocol, with 24,650 (67%) leaking password-derived authentication hashes before login. The flaw, rooted in IPMI 2.0’s 20-year-old specification, allows attackers to capture password hashes without credentials by simply initiating a connection. The vulnerability stems from IPMI 2.0’s challenge-response mechanism, which transmits a password hash during the handshake prior to authentication. The hash uses a weak derivation method, making it susceptible to offline brute-force and dictionary attacks. Attackers can recover passwords in hours to days using commodity hardware, then gain full control of the server. A compromised BMC provides out-of-band management access, including remote power control, virtual console access, and the ability to mount virtual media. Most critically, attackers can install persistent firmware backdoors that survive OS reinstallation, evading standard incident response measures like reimaging or credential rotation. Detection requires BMC firmware integrity checks, a practice rarely performed in most organizations. The flaw has been publicly known for over a decade, yet its persistence across 24,650 exposed interfaces highlights a gap in remediation. Researchers report active scanning by attackers, increasing the risk of exploitation. Since the issue is protocol-level, no firmware patch can fully mitigate it network access restrictions (e.g., VPN-only access) remain the primary defense.