DEV Community

jeffrey
jeffrey

Posted on

How many VMmanager panels are actually reachable from the internet

#security #zoomeye #vmmanager #hosting

How many VMmanager panels are actually reachable from the internet

FirstVDS disclosed on 19 October 2026 that an intruder reached its virtualisation management system through a flaw in VMmanager 6 and copied customer data from virtual server disks. ISPsystem, the platform vendor, confirmed the next day that the incident involved "a vulnerability in one of the VMmanager 6 builds" and said security updates had been released. Neither statement names a CVE, an affected version range or an exploitation method.
An operator who runs the same platform therefore has to start with a narrower question: how many VMmanager management interfaces answer from the public internet at all. ZoomEye answers the reachability part of that question without needing a version fingerprint.

What the measurement shows

Queries run on 27 October 2026 returned these counts.
| Query | Matching assets |
| --- | --- |
| title="VMmanager" | 2,823 |
| http.body="VMmanager" | 3,350 |
| title="VMmanager" && port="443" | 1,592 |
| title="VMmanager" && is_domain=true | 84 |
The search link for the title query is https://www.zoomeye.ai/searchResult?q=dGl0bGU9IlZNbWFuYWdlciI%3D.

Reading the two totals

The global totals differ by 527 assets, and the difference tracks the matching field. A title match means the page title contains the product name, which is the usual case for a login screen that labels itself. A body match also catches pages where the name appears in a footer, a licence notice or a documentation block, which helps with installations that rebrand the interface. For inventory work the title query is the tighter signal.
Neither query proves that the asset is vulnerable to the flaw FirstVDS described. A title match identifies a page signature and nothing more. Confirming a build requires reading a version string from the application, which an external scan does not do here.

No application fingerprint exists

ZoomEye has no application fingerprint for this product. app="VMmanager" returns zero assets, while the title query returns 2,823. A team that only runs fingerprint queries will conclude the platform is invisible to internet measurement, which would be wrong. The interface is present; it has to be found by its page characteristics instead of a curated app label.
Version granularity is weaker still. title="VMmanager 6" matches two assets, so build-level distribution cannot be measured from titles. Any claim that a specific number of hosts run the affected build would be an invention.

What the count does not establish

2,823 assets are not 2,823 victims. The count describes interfaces that answer publicly, in the same way a count of exposed routers describes routers rather than compromised routers. Three limits matter here. The scan cannot see installations behind a VPN or an address allowlist. It cannot separate a production control panel from a staging copy. It cannot tell whether the operator applied the updates ISPsystem released.
What it can do is size the population that a targeted attacker could enumerate with the same query. That number is the one worth using when deciding how quickly to close an interface.

Checking your own estate

The useful comparison is between the global count and the assets you control. Pull the external addresses and hostnames your organisation owns, then run the same title and body queries against those ranges and domains. A panel that answers on a public address should either sit behind an allowlisted administration path or be removed from the public internet, which is what FirstVDS did when it disabled external access to its affected management system.
ISPsystem asked customers to block inbound and outbound connections to the platform and to the virtualisation nodes, to allow only trusted administrators and vendor support, and to limit SSH to trusted addresses. Those instructions describe a target state. The measurement above shows how many operators have not reached it yet.

References

Top comments (0)