Researcher: ~13,500 iSCSI storage clusters left exposed online without a password, opening backdoors to enterprise disk storage arrays and people's NAS devices
Context & Ripple Effects
This finding extends a run of researcher discoveries about cloud-era infrastructure left open to the internet: Rubrik's passwordless server in January, the unprotected Elasticsearch cluster holding ~3.5M Panama citizen records in May, and hundreds of exposed AWS EBS snapshots leaking VPN configs and passwords later that summer.
What distinguishes this one is the layer involved: iSCSI exposes raw block-level disk over the network, so an unauthenticated cluster is not just a data leak but a potential write path into enterprise storage arrays and consumer NAS devices.
First-order effects
- Owners of the roughly 13,500 exposed clusters — enterprises running disk arrays and individuals with NAS boxes — face immediate risk of unauthorized reads and writes to their storage volumes until they add authentication or firewall the port.
Second-order effects
- The same scan-and-report playbook behind the Elasticsearch and AWS snapshot findings pushes storage vendors toward secure-by-default configurations, since each disclosure names a class of product rather than one customer's mistake.
Third-order effects
- If block-storage protocols keep being deployed on public IPs without authentication, exposure scanning becomes a standing reconnaissance industry, echoing the scale of the 12M-router embedded-server flaw from 2014 and forcing regulators to treat misconfigured infrastructure as a systemic rather than per-customer problem.
The trend: Cloud-era storage layers — object stores, snapshots, and now block devices — are being found exposed at internet scale faster than vendors can ship secure defaults.