Researcher Finds Thousands of Exposed Perforce Servers
Summary
An analysis found 6,122 internet-exposed Perforce servers in 2025. Of 2,826 still active at their original IP addresses, 1,525 allowed unauthenticated source-code access. The exposed servers included sensitive data and credentials.
Key points
- Morgan Robertson found 6,122 internet-exposed Perforce P4 servers in spring 2025.
- Of 2,826 servers still active at their original IP addresses, 1,525 allowed unauthenticated read-only source-code access.
- Among active servers, 501 allowed unauthenticated user enumeration.
- The researcher said some exposed servers held client and personal information, credentials, source code, internal projects, and product schematics.
- The initial analysis found that 4% of servers had an unprotected superuser account that could enable complete system compromise via command injection.
- Perforce disabled the remote user by default and updated its security documentation after being notified.
Article Details
- Event Type
- Research disclosure of internet-facing Perforce P4 servers misconfigured to allow unauthenticated access and expose sensitive data.
- Impact
- Morgan Robertson reported finding 6,122 publicly exposed servers in spring 2025. Exposed information included source code, client and personal information, credentials, internal projects, and product schematics. Some configurations could permit read-write access or, through an unprotected superuser account, complete system compromise via command injection. The article reports exposure risks, not confirmed compromise.
People
Vendors
Products
Helix CorePerforce P4 (formerly Helix Core) is a centralized version control platform built to handle the massive data requirements of industries like AAA gaming and semiconductor design.Perforce P4A researcher has analyzed internet-facing Perforce P4 servers and found that many are still misconfigured, exposing highly sensitive information.
Industries
AnimationRobertson said some of the unprotected systems belonged to AAA and indie game developers, universities, animation studios, interactive media firms, crypto projects, and manufacturers.Banking softwarefirm, a North American commercial EV startup, an Asian retail POS and ERP software vendor, and a banking software maker.Defensethat some of the affected servers appear to belong to major organizations, including a regional defense contractor, several medical technology providers, a North American law enforcement software vendor, anGamingPerforce P4 (formerly Helix Core) is a centralized version control platform built to handle the massive data requirements of industries like AAA gaming and semiconductor design.Industrial automationmedical technology providers, a North American law enforcement software vendor, an international industrial automation firm, a North American commercial EV startup, an Asian retail POS and ERP software vendor, and aInteractive mediaRobertson said some of the unprotected systems belonged to AAA and indie game developers, universities, animation studios, interactive media firms, crypto projects, and manufacturers.Law enforcement softwareincluding a regional defense contractor, several medical technology providers, a North American law enforcement software vendor, an international industrial automation firm, a North American commercial EV startup, anmedical technologyservers appear to belong to major organizations, including a regional defense contractor, several medical technology providers, a North American law enforcement software vendor, an international industrial automationSemiconductor designPerforce P4 (formerly Helix Core) is a centralized version control platform built to handle the massive data requirements of industries like AAA gaming and semiconductor design.