I've had the bad fortune of dealing with iLO in the past. There's absolutely nothing surprising to me that it would be remotely exploitable, as well as default remote accessible.