iDRAC/iLO typically run some sort of Linux or embedded system that is rarely updated and insufficiently fuzzed for vulnerabilities. The prevailing fallacy in ph

iDRAC/iLO typically run some sort of Linux or embedded system that is rarely updated and insufficiently fuzzed for vulnerabilities. The prevailing fallacy in physical infrastructure commodity hardware is that iDRAC/iLO, ethernet switch serial console ports, UPS/PDU management, KVMs, and so forth are supposed to be isolated on a separate, dedicated, and secured internal network and so the endpoints "don't need Defense-in-Depth."