runZero Lights Out BMC Research #
runZero has identified multiple vulnerabilities across major Baseboard Management Controller (BMC) implementations that expose BMC management subsystems to unauthorized control or disruption, which may enable network segmentation bypasses. Technical details for individual CVEs will be published as coordinated disclosure processes conclude.
BMCs are specialized microcontrollers embedded in enterprise servers that operate independently of the host operating system. These devices run dedicated firmware, maintain distinct network interfaces, and remain network-reachable even when the primary host server is powered off. Many BMC implementations rely on the Intelligent Platform Management Interface (IPMI) protocol, which was shown to contain severe architectural flaws in Dan Farmer's 2013 research concerning Cipher Zero authentication bypasses and RAKP password hash disclosure. While subsequent research has identified numerous vendor-specific BMC vulnerabilities, previous efforts have rarely re-examined core IPMI protocol implementations.
High-level details of our findings will be presented at Black Hat 2026 (Lights Out: BMCs Are Still Broken and Now We Have the Receipts) and DEF CON 34 (Lights Out: Out-of-Band, Out of Mind, Out of Control).
The following implementations are affected:
- OpenBMC
- Supermicro IPMI
- HPE iLO
- Dell iDRAC
- AMI MegaRAC
- Raritan
- H3C HDM
- Fujitsu
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to bypass security controls to access, control, or disrupt affected Baseboard Management Controllers (BMCs), which may enable lateral movement or persistence across managed enterprise infrastructure.
Are any updates or workarounds available? #
Monitor BMC vendor advisories closely and establish a formal patching process across all deployed BMC vendors. runZero will detect and flag individual vulnerabilities as disclosure deadlines expire and corresponding CVEs are published.
To protect unpatched assets, restrict management access to trusted IP addresses or internal subnets, and isolate the interface from the public Internet entirely wherever possible. If complete isolation is not feasible, ensure access is strictly limited to a secure VPN or dedicated management network. Additionally, implement enhanced monitoring on all remaining management pathways.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
(protocol:ipmi OR type:=BMC) AND (
hw:=OpenBMC OR
hw:="Super Micro IPMI" OR
hw:="HP% iLO%" OR
hw:="Dell iDRAC%" OR
hw:="AMI MegaRAC" OR
(hw:="Raritan%" AND type:="Power Device") OR
hw:="H3C HDM" OR
hw:="Fujitsu%")
