Buggy BMC Controllers Leave Thousands of Servers Open to Backdoors

Security researchers have detailed how flaws in baseboard management controllers (BMCs) from several of the world’s largest motherboard and server manufacturers could let attackers install stealthy backdoors. These out-of-band chips sit below the operating system, giving administrators remote power control, monitoring and recovery—yet the same privileged position makes a compromised BMC extremely hard to detect or remove.

For Melbourne and broader Australian businesses running on-premises or colocation infrastructure—common in finance, healthcare, universities and government suppliers—the risk is practical rather than theoretical. Many local data halls still rely on older server generations whose BMC firmware is infrequently patched. A successful exploit could survive OS reinstalls and disk wipes, undermining compliance obligations under the Privacy Act and essential-eight style controls.

What Australian IT teams should do next

Inventory every server’s BMC model and firmware version, restrict management interfaces to isolated networks or jump hosts, enforce strong credentials or certificate auth, and apply vendor updates as soon as they appear. Where vendors lag, consider network segmentation and enhanced monitoring of BMC traffic. MultiViews Australia recommends treating BMC hygiene as part of routine infrastructure reviews—especially before audit season or cloud-migration projects—so that remote-management convenience does not become a persistent blind spot.