How to Fake MySQL 8 Version to Trick Vulnerability Scanners (Step‑by‑Step)

Recently our projects across regions triggered security alerts from the group security department about MySQL 8.0.32 vulnerabilities such as CVE‑2025‑21XX, leading to daily patch testing and heavy workload.

Comments often suggest using iptables or firewalld whitelist rules, but standards differ across regions and companies; here we need port liveness and version display.

Stop patching one by one! Today we teach a trick: directly modify MySQL 8’s version string so it pretends to be 8.0.43 or even a fake 9.4.0, causing vulnerability scanners to misjudge and skip the issue.

⚠️ Disclaimer: This article is intended for internal systems, compliance scenarios, or emergency mitigation. Illegal use is not encouraged; upgrading to a fixed version is still recommended.

During high‑frequency vulnerability periods, changing the version number is the cheapest temporary defense.

✅ Method: Directly modify the binary file (for binary‑installed MySQL)

Applicable: MySQL installed from the official .tar.xz binary package.

Steps:

Find the mysqld binary:

which mysqld
# or
ps aux | grep mysqld
# Usually at: /usr/local/mysql/bin/mysqld or /opt/mysql/bin/mysqld

Backup the original file:

cp /usr/local/mysql/bin/mysqld /usr/local/mysql/bin/mysqld.bak

Modify the version string (must be same‑length replacement):

# View the string
strings /usr/local/mysql/bin/mysqld | grep "8.0.32"

# Replace with sed
sed -i 's/8.0.31/8.0.43/g' /usr/local/mysql/bin/mysqld

Locate the version entries:

8.0.32
MySQL 8.0.32

Change them to the desired version:

8.0.43
MySQL 8.0.43

🔹 Note: The new version string length must not exceed the original, otherwise the binary structure breaks.

# Restart MySQL
systemctl restart mysqld
# Verify
SELECT VERSION(); -- returns 8.0.43

External Scan Verification (simulating an attacker)

# Telnet scan
 telnet 10.10.100.111 3306

# Nmap scan
 nmap -p 3306 10.10.100.111

# Expected result:
# 3306: open → but returns fake version (8.0.43)

💬 Final Thoughts

In an era of “rainy‑day” vulnerabilities, patching is the right path, while version spoofing is a stop‑gap that can let you sleep peacefully at 3 am.

If you also use MySQL and suffer from relentless vulnerability scans, give this method a try.

👉 Found this useful? Like + share to help more ops engineers relieve anxiety!

💬 Have a better method? Feel free to comment and discuss!

Recommended Reading

MySQL 8 还在裸奔？这 6 个脚本，让你的数据库自动“穿上防弹衣”！

如何有效降低Linux服务器的Swap使用率？实战指南