29.6 million exposed OpenSSH servers. 471,859 MQTT brokers with zero authentication. 392,000 industrial control systems — no auth by design. This isn't theoretical. It's searchable right now by anyone with a $49/month Shodan subscription.
Choose your depth. The data doesn't change — just the explanation.
Check SSH versions (patch to OpenSSH 9.8p1+), disable anonymous MQTT, segment Modbus/industrial networks from internet.
The $49/mo barrier to find these machines is lower than your coffee budget. CISA has the authority to mandate remediation for federal contractors. It hasn't used it.
Your personal devices are unlikely to be directly affected. But the water treatment plant, hospital, and traffic system in your city may be running on these networks.
Every bar below represents real devices, live on the internet, right now. Red = authentication not required. The vulnerability isn't the code — it's that these services are reachable at all.
Shodan API query results, March 2026. Colors indicate auth status: red = no auth or auth commonly absent, orange = known vuln, blue = protocol issues. Note: Chart uses logarithmic scale. OpenSSH (29.6M) is 1,200x more common than EtherNet/IP (25K).
These services accepted connections with zero credentials as of Shodan's last scan. MQTT is the nervous system of IoT. Modbus controls physical infrastructure. Redis is database access.
Not theoretical bugs. Real devices. Real internet addresses. Here's what an attacker could do today.
CVE-2024-6387: Pre-authentication remote code execution as root. No login needed. 8.5M servers in the vulnerable version range (8.5p1–9.7p1). Qualys confirmed exploitation. Root access to internet servers — silently, remotely.
MQTT is the protocol running smart homes, hospitals, factories. Anyone can connect to these 471K brokers and subscribe to ALL topics — read every sensor, every message, every command. Or publish commands. South Korea alone has 279,945.
No authentication. Connect → type `CONFIG SET dir /var/spool/cron/` → write a crontab → instant root shell. This takes under 60 seconds. 58K databases are open this way. US has 11,899 alone.
Modbus was designed in 1979 for serial cables. Authentication cannot be added without breaking every device. Full read/write access to industrial registers: valve positions, motor speeds, temperature setpoints, safety interlocks.
BACnet controls HVAC, elevators, fire suppression, access control in modern buildings. 6,591 confirmed BACnet responses. Objects are fully writable: carMovingDirection, passengerAlarm, faultSignals. 71% in the United States.
Telnet = plaintext. Every username and password visible in transit. 93K routers, cameras, and IoT gateways with telnet exposed. Brazil has 30,633. Our path traversal and DHCP parsing vulnerabilities affect the entire BusyBox ecosystem.
Affects versions 8.5p1–9.7p1. Pre-auth RCE — no credentials needed. Qualys confirmed exploitation on 32-bit Linux. Shodan shows 3,528,457 servers on 9.6p1 alone. Even if only 10% are unpatched: 850,000 servers vulnerable to root takeover.
Mosquitto 1.6.x and 2.0.x memory leaks from malformed WILL messages (present for 10 years before patch). 40,879 Mosquitto instances visible. 6,784 on 1.6.15 alone. Majority running vulnerable versions.
This is not a bug. It's the protocol. 392,000 devices on port 502. 2,746 confirmed Schneider Electric devices. 167 Siemens. Each one a PLC potentially controlling a physical process — water treatment, power grid, manufacturing. The fix isn't a patch. It's network segmentation. Which clearly isn't happening.
Total unique vulnerable service instances reachable on the internet: ~37.4 million across all audited services. 13 of 14 vulnerability categories have confirmed internet-facing instances. 4 protocols have ZERO authentication by design (Modbus, BACnet, EPICS, EtherNet/IP). The attack surface documented here is available to anyone with a Shodan API key. No hacking required to find the targets.