Comment by tptacek
9 hours ago
Several large bare-metal hosting companies. Not over the open Internet, but that doesn't matter if the management networks are shared and the price of admission a single server rental.
9 hours ago
Several large bare-metal hosting companies. Not over the open Internet, but that doesn't matter if the management networks are shared and the price of admission a single server rental.
I would be concerned for e.g. Hetzner dedicated servers. They assumedly PXE-boot consumer grade UEFI hardware that is unlikely to have a dedicated management interface. Exploitability would depend on how well they filter ICMP within their network.
There is also HTTPS boot, which might be a lot more secure than PXE
https://tianocore-docs.github.io/EDKIIHttpsBootGettingStarte...