Microsoft SQL Server exposed to the internet
The short version: A Microsoft SQL Server (MSSQL) database exposed directly to the internet on port 1433 invites attackers to brute-force default, weak, and breached credentials against it — and the prize is your data.
What you need to know
There's no CVE here — the problem is that a database is reachable from the internet at all, combined with the credentials guarding it. A database should sit behind the application that uses it, not answer the open internet. When it does, its login becomes a direct, automatable target, and attackers routinely brute-force MSSQL with default accounts (like sa) and common passwords.
- How they find it — internet-wide port scanning flags MSSQL listening on 1433.
- How they use it — automated brute-forcing of default and common credential pairs, plus previously-breached passwords, against the database login.
- What it leads to — a valid login exposes sensitive data outright, and MSSQL features can let an attacker run commands on the host, turning a database breach into a server foothold.
How serious we see it
High. Two things stack here: the database shouldn't be internet-facing in the first place, and its authentication is directly brute-forceable. Even with a strong password, direct exposure of a database is an unnecessary risk we'd move to close; add a weak or default credential and it becomes a straightforward path to your data and potentially the underlying server. The reassuring part is that the fix is squarely in your hands — this is about network placement and credentials, not a vendor patch.
What to do
- Get the database off the public internet — restrict connections to the application tier and trusted IP addresses; this closes the exposure outright.
- Eliminate default and weak credentials — disable or rename default accounts and enforce strong, unique passwords.
- Require encrypted connections — so credentials and data aren't exposed in transit.
- Monitor and limit failed logins — alert on brute-force patterns against the database.
- Confirm your exposure first — verify whether any MSSQL service is reachable from the internet today.
How BreachRisk sees it
BreachRisk finds this the way an attacker would. It discovers MSSQL services exposed in your external footprint through port scanning and service fingerprinting, and then — where authorized — goes a step past flagging: it safely attempts a bounded, rate-limited authentication check using default, common, and exposed (breach-corpus) credentials, within strict non-disruptive limits rather than a brute-force flood. That's the difference between "there's a database on the internet" and "we tested its login; here's whether it holds."