A 20-year-old flaw in the IPMI 2.0 protocol has exposed around 24,000 servers worldwide to potential attacks. The vulnerability allows attackers to obtain BMC password hashes and perform offline cracking, potentially gaining full control over physical servers. Because BMC operates independently from the operating system, traditional security tools may not detect compromises. Organizations should restrict BMC access, update firmware, and use strong authentication controls to reduce risk.