Yes, they do. For example:

https://threatpost.com/plaintext-supermicro-ipmi-credentials...

Here's a search for some of them (requires a Shodan account):

https://www.shodan.io/search?query=ssl%3Aipmi