Another actively exploited vulnerability in remote access infrastructure is giving security teams a familiar assignment: identify affected systems, patch them quickly, and hope attackers have not already found them.
Cisco recently disclosed a high-severity vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. The vulnerability can allow an unauthenticated remote attacker to send specially crafted HTTP requests that cause an affected device to reload, creating a denial-of-service condition.
Attackers are already exploiting the flaw, prompting the Cybersecurity and Infrastructure Security Agency to add it to its Known Exploited Vulnerabilities catalog.
Organizations running affected Cisco software should patch immediately. But once the immediate vulnerability is addressed, security leaders and MSPs should consider the larger lesson.
This is not simply another Cisco vulnerability. It is another example of the risks created when critical remote access infrastructure remains exposed to the public internet.
The Perimeter Has Become a Target
For years, SSL VPNs and firewall-based remote access systems have provided a relatively straightforward way for employees to connect to corporate networks from outside the office.
There is an architectural tradeoff, however. To accept connections from remote users, a VPN gateway or related service typically must be accessible from the internet.
Attackers understand that.
Internet-facing VPN appliances, firewalls, and other edge devices are continuously scanned for vulnerabilities. Once a new flaw becomes known, attackers can quickly identify exposed systems and begin probing them.
That makes these devices especially valuable targets. They sit at the boundary between the public internet and internal corporate resources, and in many cases they are specifically designed to provide a pathway into those networks for authenticated users.
That makes these devices especially valuable targets. They sit at the boundary between the public internet and internal corporate resources, and in many cases they are specifically designed to provide a pathway into those networks for authenticated users.
Even when a vulnerability does not provide direct access to data or remote code execution, as is the case with this Cisco vulnerability, disrupting the device can have serious consequences. If remote access depends on a gateway and that gateway is forced offline, employees may suddenly lose access to the systems they need to work.
More serious vulnerabilities can create an even greater risk.
In recent years, security vendors have repeatedly disclosed vulnerabilities affecting VPNs, firewalls, and other remote access infrastructure. Cisco is far from alone. Products from several major security vendors have required urgent patches after vulnerabilities were discovered or actively exploited.
Viewed individually, these incidents look like unrelated CVEs. Viewed together, they reveal a broader pattern.
The Problem With the Patch Cycle
Patching remains one of the most important responsibilities in cybersecurity. When vendors release security updates for internet-facing infrastructure, organizations should deploy them as quickly as practical.
But patching is ultimately reactive.
A vulnerability must first exist. Someone must discover it. The vendor must develop a fix. Customers must learn about the vulnerability, determine whether they are affected, test the update, and deploy it.
Attackers are operating during that same window.
For large enterprises with dedicated security teams and mature vulnerability-management programs, responding quickly can still be challenging. For SMBs and the MSPs responsible for managing hundreds or thousands of customer environments, the problem becomes even more complicated.
Every internet-facing service becomes something that must be inventoried, monitored, and maintained. Every newly disclosed vulnerability can potentially trigger another emergency patching cycle.
That raises an important architectural question: How much infrastructure actually needs to be exposed to the public internet?
Reconsidering Internet Exposure
Cybersecurity has traditionally focused heavily on making exposed systems harder to compromise. Strong authentication, encryption, vulnerability management, and timely patching all remain essential.
But organizations should also regularly evaluate which systems and services need to remain externally accessible and whether that exposure is justified by the business need.
Reducing externally reachable services does not eliminate vulnerabilities. Software will always have flaws, and attackers will continue searching for them.
What it can do is reduce the number of opportunities attackers have to interact with critical infrastructure.
Limiting unnecessary internet exposure can reduce opportunities for scanning, probing, and remote exploitation. It is one layer of risk reduction that can complement patching, authentication, and other security controls.
For MSPs, this is particularly important because their customers often have limited internal cybersecurity resources. SMBs may not have teams capable of continuously tracking vulnerabilities across every firewall, VPN appliance, and remote access system they operate.
The goal should therefore be more than simply maintaining the perimeter. Organizations should also understand their external attack surface and continually evaluate whether each exposed service is necessary.
Look Beyond the Latest CVE
The latest Cisco vulnerability will be patched. Security teams will deploy the updates, scanners will eventually stop flagging vulnerable versions, and attention will move to the next critical vulnerability.
But another vulnerability will come.
That is why each new incident involving internet-facing remote access infrastructure should prompt more than an emergency patch cycle. It should prompt organizations to examine the assumptions behind how remote access is designed.
For years, the industry has largely accepted that providing remote connectivity requires placing reachable services at the edge of the network and then defending them.
The ongoing stream of vulnerabilities affecting VPNs, firewalls, and other edge devices suggests organizations should continue to reassess their external attack surface and the controls that protect it.
______
About Kent Lawson
Kent Lawson is the CEO of Private Communications Corporation, a cybersecurity company he founded in 2012 to deliver fast, reliable, and private VPN connectivity for businesses and consumers alike. Today, PCC’s flagship products include Private WiFi, a consumer-facing VPN platform, and Remote WorkForce Enhanced VPN, a cloud-native solution built for the MSP channel that offers The Glide Path to ZTNA™, giving partners a proven, margin-rich framework for modernizing client security without disruption.
Join our LinkedIn group Information Security Community!
