What happened
Analysis and impact
BMC 的设计初衷是让运维人员能在操作系统崩溃或关机状态下远程管理服务器，包括重启、安装系统、监控硬件状态等。正因如此，它独立于主 CPU 运行，拥有自己的固件、网络接口和存储空间。这种架构也意味着，传统杀毒软件和操作系统层面的防护手段对 BMC 几乎无效。据 Ars Technica 报道，研究人员发现多家头部厂商的 BMC 固件在实现上存在可被利用的漏洞，攻击者能够借此植入持久性后门，且难以被常规检测手段发现。
报道指出，受影响范围覆盖全球最大的几家服务器主板与整机制造商，涉及数千台已部署设备。原文未提供具体厂商名单与漏洞技术细节，但强调问题的普遍性——并非个别型号的偶发缺陷，而是 BMC 生态中长期积累的安全债务。由于 BMC 常用于数据中心、云服务商和企业核心机房，此类漏洞的实际影响可能远超单台服务器，波及托管在同一基础设施上的大量业务。
从攻击链条来看，BMC 后门的危险在于其隐蔽性与持久性。即便管理员重装操作系统、更换硬盘，只要 BMC 固件中的恶意代码未被清除，攻击者仍能重新获得控制权。原文未提供已发生的实际攻击案例，但安全研究者通常将这类能力视为高级持续性威胁（APT）的理想工具。当前公开信息尚不足以判断漏洞是否已被野外利用，相关厂商的修复进度也未在报道中披露。
References
Original source text
Thousands of Internet-connected servers sold by the world’s biggest manufacturers can be remotely backdoored by exploiting critical vulnerabilities—some more than a decade old—that lurk deep inside system motherboards, according to research presented Wednesday.
Baseboard management controllers are miniature computers that are embedded into the motherboards of virtually every enterprise server. The microcontrollers, typically abbreviated as BMCs, run with their own operating system firmware, network stack, and IP address. Administrators rely on them to monitor the physical status of large fleets of servers and to perform a variety of tasks, including rebooting machines, installing updates, and even reinstalling operating systems. BMCs provide what’s known as “lights out” and “out-of-band” management because they work even when servers they’re attached to are turned off or are unresponsive.
A “pervasive, under-monitored, under-patched parallel attack surface” Researchers have warned since at least 2013 that BMCs present a golden opportunity for hackers looking for ways to gain deep and persistent access to datacenters. The chief culprit was IPMI, the protocol that allows BMCs to operate independently of servers and to perform administrative tasks. Vulnerabilities in this firmware made it possible for attackers to remotely execute malicious code on the controllers and, from there, infect the servers they manage.