Thousands of remote hardware controllers sit exposed online, enabling offline password attacks that bypass OS-level defenses and hand attackers full server control.