Many appliance break-ins begin with a management login that someone inadvertently left accessible from any location.
Instead of trusting whoever reaches the login page, it verifies the user and the device before the interface ever sees them.
Aberdeen’s research finds zero trust network access and similar categories gaining ground while traditional VPNs begin their long phase-out.
Cloud-managed consoles take the same idea further by keeping the login page off your perimeter.
It’s not a glamorous undertaking, but it certainly beats reading about your own login page in a Talos incident report.
Earlier this month, Cisco’s Talos team reportedOpens a new window that a ransomware operator had logged into a victim’s Secure Firewall Management Center (FMC) using a password hard-coded into the software. From there, the intruder mapped the network, harvested credentials, and drew up a list of endpoints to encrypt before deploying Qilin ransomware.
The flaw, tracked as CVE-2026-20316, lets a remote attacker sign in to an unpatched FMC with a low-privileged accountOpens a new window and reach sensitive data. Cisco published its advisory on July 29, the same day CISA added the bug to its Known Exploited Vulnerabilities catalogOpens a new window . Cisco also noted that the attack surface shrinks when the FMC management interface doesn’t face the public internet.
Many appliance break-ins begin with a management login that someone inadvertently left accessible from any location. You can find your exposed interfaces with some of the same tools attackers use, keeping remote administration without leaving a login page on the open internet—but don’t be surprised if the first scan turns up something you’d forgotten about.
READ MORE: Emergency patching for small IT teams
Why management logins end up facing the internet
It all started with a choice that was reasonable at the time. Somebody enabled remote management before a trip, a vendor’s setup wizard made the checkbox look harmless, or port forwarding from an old emergency stuck around because nobody ever changed it back. But after you moved on, attackers might have noticed and started kicking the tires.
It’s worth their while to do so. According to Rapid7’s 2026 threat landscape reportOpens a new window , RDP and VPN were the access types most often offered for sale on underground forums, at 21.2% and 12.8%. The average asking price was $113,275. Business, unfortunately, is good.
If you think the bad actors who buy this kind of information are only interested in targeting big fish, think again. This year’s Verizon Data Breach Investigations Report tied 29% of the ransomware victimizations it tracked at small and midsize businesses to unpatched flaws in edge devicesOpens a new window and another 38% to compromised credentials. That trade runs on login pages that answer from the outside.
CISA has treated those exposed logins as a hazard since 2023. Its Binding Operational Directive 23-02 gives federal agencies 14 days to actOpens a new window on any in-scope management interface found exposed to the internet. It allows exactly two fixes: move the interface onto an internal network, or put an access checkpoint in front of it that operates separately from the interface itself.
This directive likely doesn’t apply to your company, granted. But it comes from the agency that tracks real-world exploitation for a living, and it tells you the minimum standard the government’s own defenders will accept. That’s a reasonable bar to aim for.
Find your exposed management interfaces before someone else does
Shodan crawls the public internetOpens a new window and indexes every service that responds, from web servers to industrial gear, along with the banners that reveal what each one is. CISA warns that threat actors use the same platformsOpens a new window to find targets they can exploit, but two can play that game. You can also use this tool to look up your company’s public IP addresses and see your network the way an outsider sees it, login pages included.
READ MORE: Has Microsoft’s patch cycle become fat patch Tuesday?
The Shadowserver Foundation will do the watching for you. The nonprofit scans the whole internet every day and offers free daily remediation reportsOpens a new window tailored to your own network. You can sign up with the IP ranges your company controls, and a rundown of accessible services and suspicious activity will arrive by email or API.
While you wait for that first report, you can run an external vulnerability scan of your public addresses whenever you have a free moment (rare in the world of IT, I know). Whatever combination you use, keep an eye out for:
Admin pages on firewalls, routers, and VPN appliances
Exposed remote desktop services and RMM tools
Hypervisor consoles and NAS web interfaces
Out-of-band management ports like iLO and iDRAC, plus UPS network cards
Anything a vendor set up with remote support enabled, from cameras to phone systems
Every one of those services is likely reachable because somebody turned it on, usually to enable remote work or vendor support. Shutting them off only works for good if the people who relied on them get a safer way in.
Remote administration without a public login page
So where does that leave remote administration? Most of the gear on the list above belongs on an internal network or a management VLAN, reached over the VPN your team already uses. Since your VPN portal is probably internet-facing as well, it’ll need MFA and prompt patching. Ultimately, you’ll want one well-defended entrance instead of a dozen scattered admin pages.
Some devices can’t join the VPN path, and a few vendors require their own remote access tools for support. For those, consider allowlisting the handful of IP addresses that legitimately manage the box or routing admin sessions through one hardened jump host that you log and watch.
CISA’s directive defines its preferred fix, the access checkpoint, as part of a zero trust architecture. Instead of trusting whoever reaches the login page, it verifies the user and the device before the interface ever sees them. Aberdeen’s research finds zero trust network access and similar categories gaining ground while traditional VPNs begin their long phase-out. The checkpoint only helps when your team implements zero trust as a discipline rather than simply installing it as a product.
Cloud-managed consoles take the same idea further by keeping the login page off your perimeter. Cisco’s cloud-delivered FMC wasn’t affected by this flaw at all. If you’re running the on-premises version, that might be a little frustrating. If you go with a cloud option, you’re of course trading your exposed page for trust in the vendor’s cloud—so it’s worth considering the pros and cons involved with that decision.
Recheck your internet exposure on a schedule
As you might have guessed, this isn’t a one-and-done exercise. Exposed services can quickly pile right back up as you replace gear and vendors ask for remote access to provide support. You can get ahead of the problem by running this check on a regular basis.
It’s not a glamorous undertaking, but it certainly beats reading about your own login page in a Talos incident report. Shadowserver keeps watching your ranges every day once you subscribe, and a quarterly pass through your own scan results helps catch what changed in between. Consoles that must stay reachable should be included in your threat detection coverage, too.
When new equipment arrives, decide whether its console needs to face the internet the same way you’d weigh any other risk in change control. And when the next hard-coded password turns up in an appliance—a scenario that could very well happen, as we’ve seen—the story will send you to a scan you already ran on interfaces you moved off the open internet. Instead of scrambling, you can check the morning report, confirm the affected device isn’t visible from the outside, and get on with your day.
I reached out to Cisco for comment on this story, but the company did not provide one by publication time. I will update this reporting if that changes.
