Eclypsium reported roughly 1,000 internet-exposed instances in a Shodan search associated with its MegaRAC Redfish investigation; exposure is not confirmed exploitability of every instance
~1,000 exposed instancesobserved
| Value kind | observed — Reported measurements, counts, and specifications keep the precision and scope stated by their source; an exact specification is not treated as a range. |
|---|---|
| Scope | Historical search result, not a census of compromised or currently vulnerable BMCs. |
| As of | Publication 18 March 2025; scan day not specified |
| Source | Eclypsium, BMC&C: Redfish Alert 3, 18 March 2025, Part 3 exposure discussion. · Section “BMC&C Vulnerabilities – Part 3”: Shodan search revealed roughly 1,000 exposed instances |
| Review | checking…review by 2026-10-24 · standard cadence |
| Recorded changes | last 2026-06-29 |
| Claim id | internet-exposed-megarac-sp-x-redfish-instances |
Where the guide uses it
Not quoted in a chapter yet; it is kept in the curated register.
← Full numbers register — every date-stamped figure in the guide, with revision history.