Nearly 25,000 publicly exposed BMCs are vulnerable through CVE-2013-4786, a 20-year-old flaw that grants attackers direct access to server hardware and potentially the entire management infrastructure.