欠陥のあるマザーボードコントローラを悪用して数千台のサーバにバックドアが仕掛けられる恐れThousands of servers can be backdoored by exploiting buggy motherboard controllers

Security researchers have disclosed a set of serious vulnerabilities in the baseboard management controllers (BMCs) embedded in servers from several of the world's largest hardware manufacturers, warning that the flaws could allow attackers to plant persistent backdoors on thousands of machines. The disclosure matters because BMCs operate beneath the operating system, giving an intruder a foothold that is exceptionally difficult to detect and even harder to remove once established.

A BMC is a small, independent computer soldered onto a server motherboard. It has its own processor, memory, firmware, and often a dedicated network connection, and it runs whether or not the host system is powered on. Administrators rely on this out-of-band access to monitor hardware health, reinstall operating systems, mount virtual media, and reboot or reconfigure machines remotely—capabilities that are indispensable in large data centers where physically touching each server is impractical. The same deep privileges that make BMCs useful also make them a high-value target.

Because a BMC sits below the OS layer, code running on it is effectively invisible to the endpoint detection tools, antivirus software, and logging agents that defenders typically deploy inside the operating system. An attacker who gains control of the controller can potentially survive OS reinstalls, disk wipes, and in some cases even firmware updates, while reaching into the host to read memory, alter boot processes, or re-implant malware. That combination of stealth and durability is why the exposure is being described as particularly dangerous, and why researchers characterize the current state of BMC security as a mess.

BMC functionality is commonly exposed through the Intelligent Platform Management Interface (IPMI), an older standard long criticized for weak authentication, and increasingly through Redfish, a more modern REST API defined by the DMTF standards body. Major vendors layer their own management stacks on top of these controllers, such as Dell's iDRAC, Hewlett Packard Enterprise's iLO, Lenovo's XClarity, and Supermicro's implementations. Much of the underlying firmware across the industry originates from a small number of suppliers—American Megatrends' MegaRAC being one of the most widely deployed—which means a single defect can ripple across many otherwise unrelated brands.

This is not the first time BMCs have drawn scrutiny. In 2022 and 2023, firmware security firm Eclypsium published a series of flaws in MegaRAC, collectively branded "BMC&C," that similarly enabled remote code execution and persistence. The recurrence of comparable issues suggests that supply-chain concentration and the difficulty of patching low-level firmware remain unresolved structural problems rather than isolated bugs. When many server brands depend on shared components, a weakness in that common code can propagate widely before it is understood or fixed.

The practical risk depends heavily on exposure. Management interfaces that are reachable from the public internet, or that share a network with general workloads, dramatically widen the attack surface. Security guidance for BMCs has been consistent for years and appears to apply here as well: keep management interfaces off the public internet, place them on isolated management networks, disable unused or legacy protocols such as older IPMI variants, enforce strong and unique credentials, and apply vendor firmware updates promptly. Organizations that cannot immediately patch are likely to rely on network segmentation to limit exposure while fixes are tested and rolled out. Firmware updates on controllers of this kind can be slow and operationally sensitive, since a failed flash can disable remote management or, in the worst case, the server itself.

For enterprise and cloud operators, the concern is scale. A data center may contain thousands of identical servers, and a flaw affecting a common controller could, in principle, touch a large fraction of a fleet at once. A compromised BMC is also an attractive pivot point for lateral movement, because it can influence the host it manages and may hold administrative credentials.

The full scope of the issue—including exactly which models are affected, whether any of the flaws have been exploited in the wild, and the timeline for coordinated patches—will likely become clearer as vendors publish advisories and remediation guidance. In the meantime, the disclosure is a reminder that the trusted, below-the-OS components that keep modern servers manageable can themselves become the weakest link, and that securing infrastructure increasingly means looking beneath the software stack most defenses are built to watch.