An attacker can retrieve password hashes from an exposed Baseboard Management Controller (BMC) via UDP port 623 without authentication by exploiting a design flaw in the IPMI 2.0 handshake protocol. This allows pre-login access to the low-level controller that manages power, virtual media, and firmware on the host, a layer typically unmonitored by host-based security tools. The article does not specify a CVE, CVSS score, affected versions, or available patches, but the primary mitigation is to ensure BMC interfaces are not exposed to untrusted networks.
An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced in 2004. That controller runs underneath the operating system. It power-cycles the host, mounts virtual media, opens a remote console, and flashes firmware. Host security tools watch the layer above it. Example BMC web … More → The post Exposed BMCs hand out password hashes before login appeared first on Help Net Security .