Unit 10: Edge devices and remote access · Lesson 1 of 5 · 20 min
Case file: admin panels on the internet
Read the external attack surface report, find management interfaces and end-of-life devices, and decide what comes off the internet today.
case file
F5 BIG-IP Source Code Theft
F5 · 2025
F5 disclosed on October 15, 2025 that a nation-state actor with long-term persistent access had taken portions of BIG-IP source code and information on undisclosed vulnerabilities from its product development environment, plus some customer configuration data. F5 learned of the breach on August 9, 2025, and delayed disclosure at the US Department of Justice's request; reporting linked the activity to BRICKSTORM malware and the China-nexus group UNC5221. CISA's Emergency Directive 26-01 required federal agencies to inventory BIG-IP devices, check management-interface exposure, patch and disconnect end-of-life devices.
What went wrong
Long-undetected persistence in a vendor's development and knowledge-management environment; for customers, the risk was internet-exposed management interfaces and end-of-life devices facing likely future exploits.
What would have stopped it
- Customers: never expose device management interfaces to the internet; restrict them to a management network.
- Maintain an inventory of edge devices and retire end-of-life hardware/software.
- Apply vendor security updates quickly after a vendor breach, assuming attackers may develop exploits from stolen code.
- Vendors: segment development environments and monitor for long-dwell persistence on infrastructure that lacks EDR.
What defenders could have seen
- External attack-surface scan showing a BIG-IP management interface reachable from the internet.
- Unusual administrative logins or configuration exports on BIG-IP devices.
- Outbound connections from network appliances to unfamiliar hosts.
mission
- You are
- The network lead after a vendor breach notice.
- Situation
- A vendor reports that attackers stole its source code. Edge devices are the first targets when exploits follow. The attack surface report for corp.example is
~/edge/asm-scan.csv. This lab is modelled on the F5 breach and CISA's Emergency Directive 26-01. - Goal
- List every management interface reachable from the internet and every end-of-life device.
- Hand in
- A list of what to restrict today and what to replace.
The castle gates
Read the report
Each row is one open port on a public address, with the product and whether it is a management interface.
cat asm-scan.csv
ip,port,device,product,version,interface,end_of_life
203.0.113.1,443,fw01,edge firewall,9.1.4,vpn portal,no
203.0.113.1,4443,fw01,edge firewall,9.1.4,management,no
203.0.113.10,443,vpn01,SSL VPN appliance,22.7R2.1,vpn portal,no
203.0.113.12,443,lb01,load balancer,15.1.8,public website,yes
203.0.113.12,8443,lb01,load balancer,15.1.8,management,yes
203.0.113.14,443,vpn-old,SSL VPN appliance,8.2.1,vpn portal,yes
203.0.113.20,8443,sdwan-mgr,SD-WAN manager,20.12.4,management,no
203.0.113.30,8123,analytics01,ClickHouse,24.3,database,no
Filter for management interfaces
A management interface on the internet is a finding even when it is patched. It is the door attackers try first.
grep ',management,' asm-scan.csv | cut -d, -f1,2,3
203.0.113.1,4443,fw01
203.0.113.12,8443,lb01
203.0.113.20,8443,sdwan-mgr
you should see Three devices expose their admin panel: fw01, lb01 and the SD-WAN manager.
Find end-of-life devices
End-of-life products get no more fixes. Every new vulnerability stays open forever.
grep ',yes$' asm-scan.csv | cut -d, -f3 | sort -u
lb01
vpn-old
you should see lb01 and an old VPN appliance are past end of life, and lb01 also exposes management.
defender tip Move admin access to a dedicated management network or a jump host reachable only over the company VPN with MFA.
Count the exposed devices
Every device in this list is a target that needs an owner and a patch plan.
tail -n +2 asm-scan.csv | cut -d, -f3 | sort -u | wc -l
6
you should see Six devices are reachable from the internet.
What a defender takes away
- 1Keep an inventory of everything reachable from the internet, and scan it yourself.
- 2Management interfaces never belong on the internet.
- 3After a vendor breach, assume exploits will follow and patch or isolate first.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.