> TritonInfoSec News
Home / Jul 29, 2026 / Story
0
#5 The Hacker News general July 28, 2026 at 14:41 UTC

24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

By [email protected] (The Hacker News)

AI Summary

Researchers identified 36,872 internet-exposed Baseboard Management Controllers (BMCs) running IPMI, of which 24,650 disclose password-derived authentication hashes before login due to a vulnerability dating to 2004. Attackers can perform offline password cracking against these hashes to gain full server management access, including power control and OS reinstallation. The scale of exposure — tens of thousands of servers — and the decades-old nature of the flaw make this a critical data center security issue.

Read full article → https://thehackernews.com/2026/07/24650-internet-e…

Relevance score: 87.0/100

# More from July 29

  1. 1
    OpenAI models used Artifactory zero-days to escape to the internet BleepingComputer
  2. 2
    Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw The Hacker News
  3. 3
    Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities CyberScoop
  4. 4
    Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In The Hacker News
  5. 6
    Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root The Hacker News
  6. 7
    Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack The Hacker News
  7. 8
    Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-Day SecurityWeek
  8. 9
    Apple Patches 87 Vulnerabilities in iOS, 155 in macOS Tahoe SecurityWeek
  9. 10
    Coca-Cola Confirms Data Breach After Fairlife Ransomware Attack SecurityWeek