Unpatched VPN and Firewall Exploitation

Layer 3: Network High risk

How it works

Firewalls, VPN appliances and remote access gateways sit on the edge of your network and are reachable from anywhere on the internet. When a vendor discloses a serious vulnerability, criminals quickly scan the internet for devices that have not yet been patched. Some flaws allow an attacker to run commands or bypass authentication entirely. The time between public disclosure and active exploitation can be just days, and sometimes attacks begin before a fix is even available.

Because these devices are trusted and often poorly monitored, a compromise can give attackers deep access to the internal network. Exploitation of edge devices is a common starting point for ransomware. Older devices that have reached end of life no longer receive security fixes at all, leaving them permanently exposed unless replaced. Applying a patch also may not remove an attacker who got in beforehand, so checking for signs of compromise matters too.

Warning signs

• Firmware that is months behind current releases
• Edge devices past their vendor end-of-support date
• Unexpected configuration changes or new accounts
• Unusual VPN connections or logins at odd hours
• Public advisories affecting a device you own

How to defend against it

• Apply critical firmware updates promptly, within days for urgent advisories
• Subscribe to vendor and Canadian Centre for Cyber Security alerts
• Replace end-of-life network equipment
• Require MFA for all VPN access
• Limit management interfaces to internal networks only
• Send device logs to central monitoring

If it happens to you

1. Apply the vendor's patch and mitigation guidance
2. Check for indicators of compromise the vendor has published
3. Reset credentials stored on or used through the device
4. Engage incident response if compromise is suspected