Recent weeks have seen a surge in severe vulnerabilities affecting edge security products, which are now being exploited by attackers seeking easy access to networks. Vulnerabilities in devices like VPNs and firewalls have drawn attention as viable alternatives to phishing attacks. Notably, the Cybersecurity and Infrastructure Security Agency (CISA) has identified several significant vulnerabilities, including authentication bypasses in products from Palo Alto Networks and SonicWall. The continual targeting of such security devices reveals critical risks for organizations. Affected: edge security products, VPN appliances, SonicWall, Palo Alto Networks, Ivanti, Cisco, telecom companies
Keypoints :
- Exploitation of perimeter devices has surpassed phishing as a common entry vector for cyberattacks since 2021.
- Attacks on edge security products like VPNs and file transfer services have become a trend among threat actors involved in Big-Game Hunting (BGH).
- CISA added seven vulnerabilities in security devices to its Known Exploited Vulnerabilities (KEV) catalog in the last two months.
- Critical vulnerabilities include authentication bypass and remote code execution flaws in products from companies like Palo Alto Networks and SonicWall.
- Ivanti disclosed four critical vulnerabilities that affect its popular enterprise products.
- 40% of exploitation activity targeted internet-facing devices like firewalls and routers last year.
- Chinese state-backed actors have been observed exploiting vulnerabilities in Cisco’s software targeting U.S. telecom companies.
- The security community has consistently raised concerns about the vulnerabilities in edge security devices.
- Threat actors take advantage of management consoles exposed to the internet, increasing the risk of exploitation.
- Updating and monitoring edge security products is crucial, but often overlooked by administrators.
- Utilizing tools like Censys’s Attack Surface Management can help organizations manage vulnerability exposure.
MITRE Techniques :
- T1190 – Exploit Public-Facing Application: Threat actors are exploiting vulnerabilities in perimeter devices like VPN appliances and firewalls.
- T1193 – Spear Phishing: While traditional phishing remains a concern, recent trends show a shift towards exploiting device vulnerabilities.
- T1203 – Exploitation for Client Execution: Specific authentication bypass vulnerabilities allow attackers to gain privileged access to devices.
- T1068 – Exploitation of Elevation of Privilege: Adversaries exploit critical vulnerabilities to execute arbitrary commands on compromised devices.
- T1071 – Application Layer Protocol: Attackers are leveraging known vulnerabilities in well-known security products targeting enterprise settings.
Full Story: https://censys.com/the-lurking-threat-of-edge-security-products/
Views: 9