Microsoft says hackers used vulnerabilities in the Boa web server, discontinued in 2005 but widely used across IoT devices, to target the Indian power sector
Current Description /cgi-bin/wapopen in BOA Webserver .94.14rc21 allows … Katie McCafferty / Microsoft Security Blog : Vulnerable SDK components lead to supply chain risks in IoT and OT environments TechCircle : Hackers attacking energy sector using decades-old software, says Microsoft Pierluigi Paganini / Security Affairs : Threat actors exploit discontinues Boa web servers to target critical infrastructure Duncan Riley / SiliconANGLE : Microsoft warns hackers are targeting long-discontinued Boa web server Mihir Bagwe / InfoRiskToday.com : Tata Power Attack Linked to Bug in Nearly 20-Year-Old Server Habiba Rashid / HackRead : Retired Software Exploited To Target Power Grids, Microsoft
Context & Ripple Effects
The warning fits a longer record of unsupported network software remaining deployed well past its maintenance life, from actively exploited IIS 6.0 installations to an older embedded web-server component that left home routers exposed. Boa's presence in IoT and operational-technology products makes the problem a component-supply-chain issue rather than solely an individual operator's configuration problem.
Critical infrastructure has faced related exposure through vulnerable industrial Ethernet switches used at power facilities. Microsoft’s identification of Boa in attacks on the Indian power sector puts a specific legacy component at the center of that broader OT security risk.
First-order effects
- Indian power-sector organizations using IoT or OT equipment with Boa web-server components face an immediate need to identify exposed devices and remove, replace, or isolate the vulnerable service.
- Device makers and SDK suppliers whose products incorporated Boa face scrutiny over whether their deployed products can be updated despite the server having been discontinued.
Second-order effects
- Power operators’ procurement and security teams gain a reason to require component inventories and supported-software commitments from IoT and OT suppliers, not just vulnerability fixes after deployment.
- Attackers can reuse weaknesses in widely distributed embedded components across multiple device brands, increasing the value of supply-chain-focused defensive research such as earlier reporting on exposed embedded web-server software.
Third-order effects
- If legacy embedded components continue to persist in critical environments, OT security will increasingly hinge on vendors’ long-term software-maintenance and replacement paths rather than on perimeter defenses alone.
- The pattern favors security programs that treat firmware and bundled SDKs as traceable supply-chain dependencies, especially where critical operators cannot rapidly replace field devices.
The trend: Critical-infrastructure security is shifting toward managing long-lived, third-party software components embedded across IoT and OT equipment.