CVE-2012-2122: MySQL and MariaDB authentication bypass via repeated wrong password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityPublic exploit code exists and EPSS is very high, but the CVSS 2.0 base score is only 5.1 and exploitation requires a specific memcmp environment.

What it is

Oracle MySQL and MariaDB compare password tokens with memcmp in certain environments, and the return value is not checked properly. Repeatedly authenticating with the same incorrect password can eventually make the token comparison succeed, bypassing authentication entirely.

Impact

An attacker gains authenticated access to the database server without valid credentials, potentially reading or modifying data and executing SQL with the privileges of the targeted account.

Attack surface

Reachable remotely over the MySQL protocol (AV:N) with no authentication required (Au:N) and no user interaction. Exploitation depends on the target running in an environment with a memcmp implementation that triggers the flawed comparison (AC:H).

Exploitation

CISA KEV does not list it, but EPSS is 0.965 (99.879th percentile) and multiple references are tagged Exploit, including Exploit-DB and Metasploit coverage, indicating public exploit code exists.

What to do

• Upgrade MySQL to 5.1.63, 5.5.24, or 5.6.6 and later, or MariaDB to 5.1.62, 5.2.12, 5.3.6, or 5.5.23 and later.
• If immediate patching is not possible, restrict network access to the database port to trusted hosts only.
• Disable or tightly control remote root and other privileged account logins from untrusted networks.
• Monitor for and block repeated failed authentication attempts from the same source.
• Apply vendor advisories for OpenSUSE and Gentoo where the affected packages are used.

Detection

• Alert on bursts of failed authentication attempts from a single source followed by a successful login.
• Review MySQL/MariaDB authentication logs for repeated identical incorrect-password attempts.
• Hunt for known exploit tooling or Metasploit module traffic against the database port.
• Baseline and monitor successful logins from unexpected hosts or accounts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.