MySQL exposed to the internet
The short version: A MySQL or MariaDB database exposed directly to the internet invites attackers to brute-force default, weak, and breached credentials against it — and the prize is your data.
What you need to know
There's no CVE here — the problem is that a database is reachable from the internet at all, combined with the credentials guarding it. A database belongs behind the application that uses it, not answering the open internet. When it's exposed, its login becomes a direct, automatable target, and attackers routinely brute-force MySQL with default accounts (like root) and common passwords.
- How they find it — internet-wide port scanning flags MySQL/MariaDB listening on its database ports (3306 and related).
- How they use it — automated brute-forcing of default and common credential pairs, plus previously-breached passwords, against the database login.
- What it leads to — a valid login exposes sensitive data outright, and can provide a foothold to expand toward the systems around it.
How serious we see it
High. Two things stack here: the database shouldn't be internet-facing in the first place, and its authentication is directly brute-forceable. Even with a strong password, direct exposure of a database is an unnecessary risk we'd move to close; add a weak or default credential and it becomes a straightforward path to your data. The reassuring part is that the fix is squarely in your hands — this is about network placement and credentials, not a vendor patch.
What to do
- Get the database off the public internet — restrict connections to the application tier and trusted IP addresses; this closes the exposure outright.
- Eliminate default and weak credentials — remove anonymous and default accounts and enforce strong, unique passwords.
- Require encrypted connections — so credentials and data aren't exposed in transit.
- Monitor and limit failed logins — alert on brute-force patterns against the database.
- Confirm your exposure first — verify whether any MySQL/MariaDB service is reachable from the internet today.
How BreachRisk sees it
BreachRisk finds this the way an attacker would. It discovers MySQL services exposed in your external footprint through port scanning and service fingerprinting, and then — where authorized — goes a step past flagging: it safely attempts a bounded, rate-limited authentication check using default, common, and exposed (breach-corpus) credentials, within strict non-disruptive limits rather than a brute-force flood. That's the difference between "there's a database on the internet" and "we tested its login; here's whether it holds."