Thousands of server motherboards are vulnerable to controller flaws that could give attackers hardware-level control

That deep level of control makes BMCs valuable for IT operations but dangerous if attackers gain access. As many as 75,000 remained vulnerable to CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol that allows attackers to crack administrator passwords offline. Some involve IPMI authentication, while others affect session security, memory management, and the handling of firmware and secrets. One category of vulnerabilities stems from flaws in the IPMI authentication handshake. In some systems, firmware is unsigned or can be modified by attackers, while configuration integrity checks are not enforced.