Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildouts

Impact

Shodan-visible BMCs are a recurring finding at colo/neocloud buildouts — a management interface reachable from the internet turns every BMC CVE above into a directly exploitable, pre-auth, below-OS foothold

Who can reach it

Network, from the public internet

What to do

Continuous external attack-surface scanning of the management ranges plus an enforced out-of-band network design; the operational cost is that remote-hands and vendor support workflows often depend on the exposure

References

Related entries

• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored
• NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationNCVD-0000-006-nvme-of-over-rdma · NVMe-oF over RDMAUnscored
• Facility power / DCIM as a class: PDUs, CRAC controllers, BMS and DCIM platforms run long-lived embedded firmware, sitNCVD-0000-007-facility-power-dcim-as-a-class · Facility power / DCIM as a classUnscored
• Firmware signing-key compromise as a class: Firmware trust anchors (Boot Guard KM/BPM, UEFI PK/KEK, BMC image-signingNCVD-0000-008-firmware-signing-key-compromise · Firmware signing-key compromise as a classUnscored
• Redfish implementations (all vendors): Redfish replaced IPMI but reintroduced the same class of flaws at the HTTP layerNCVD-0000-009-redfish-implementations-all-vend · Redfish implementations (all vendors)Unscored