Edge Device Hardening: Routers, Firewalls, and Network Perimeter Security

Edge devices—routers, firewalls, VPN concentrators, and other network perimeter equipment—are the gatekeepers between organizational networks and the internet. When edge devices are compromised, attackers gain a trusted position inside the network perimeter from which detection is difficult and lateral movement is facilitated. Russia's Sandworm and other state-sponsored groups have consistently targeted edge devices as preferred initial access vectors, exploiting unpatched vulnerabilities and default credentials in routers and firewalls across Ukrainian government and critical infrastructure networks.

Default Credential Elimination

Network equipment shipped from manufacturers includes pre-configured default credentials—typically well-documented in vendor manuals and searchable online. Routers with default credentials of "admin/admin" are trivially accessible to anyone who can reach their management interface. Despite the simplicity of this vulnerability and the ease of remediation, default credential retention remains a persistent problem across Ukrainian networks, particularly in smaller organizations and municipal utilities that lack dedicated IT security staff.

Campaigns conducted by Russia-linked threat actors documented by CERT-UA and international partners have used automated credential stuffing against known default credentials across ranges of Ukrainian IP addresses, successfully accessing routers and firewalls in organizations that had deployed equipment but never changed manufacturer default passwords. The automated nature of these campaigns allows attackers to scan and compromise thousands of edge devices across a country in days, creating a large inventory of initial access footholds for subsequent exploitation.

Firmware Update Enforcement

Router and firewall firmware vulnerabilities are consistently among the most exploited vulnerabilities by nation-state actors. Critical vulnerabilities in widely-deployed edge devices (Cisco, Fortinet, Zyxel, MikroTik, Netgear) are discovered regularly and exploited by sophisticated attackers within days or hours of public disclosure. MikroTik routers—extremely widely deployed in Ukraine due to their low cost and versatility—have been exploited in multiple documented campaigns targeting Ukrainian infrastructure, with attackers exploiting known firmware vulnerabilities against unpatched devices.

CERT-UA monitors firmware vulnerability disclosures and distributes regular advisories urging operators to apply updates, but centralized enforcement of firmware update compliance across all Ukrainian network infrastructure remains technically challenging. Organizations have been directed to implement automatic update mechanisms where available, establish firmware version tracking inventories, and prioritize patch application for internet-exposed edge devices above all other patch management priorities.

Edge Device Hardening Controls by Category

Shodan Attack Surface Reduction

Shodan is a public internet scanning service that indexes internet-connected devices and their exposed services. Attackers use Shodan to identify vulnerable edge devices before launching targeted exploitation campaigns. CERT-UA and Ukraine's SSSCIP have used Shodan monitoring as a component of national attack surface management—tracking the number of Ukrainian IP addresses with exposed management interfaces and vulnerable services, and issuing notifications to identified vulnerable organizations.

Measuring attack surface reduction through Shodan indexing provides a quantitative metric for security improvement: the number of Ukrainian government and critical infrastructure IP addresses with internet-exposed router management interfaces, unprotected Telnet services, and known vulnerable firmware versions has served as a key performance indicator for national cyber defense improvement programs. Organizations that receive Shodan-based vulnerability notifications and fail to act have been escalated through regulatory channels for enforcement action.

Access Control and Management Interface Security

Beyond credential hygiene and firmware currency, hardening edge device management access requires strict access control: limiting management interface access to administrative jump hosts, implementing multi-factor authentication for device administration, logging all administrative sessions, and disabling unused remote management protocols (Telnet, HTTP, SNMP v1/v2c). VPN concentrators—which serve as the primary remote access gateway for organizations during wartime when staff work from dispersed locations—require particularly rigorous access controls given their privileged position in network architecture.

Post-Compromise Detection for Edge Devices

Compromised edge devices are particularly difficult to detect because they can filter their own traffic logs and appear to function normally while silently forwarding copies of all passing traffic to attacker infrastructure. Detection methods include out-of-band integrity verification comparing device running configuration against known-good stored configurations, firmware hash verification against manufacturer-provided checksums, and network traffic analysis from external monitoring points that cannot be affected by device compromise.

FAQ

Why do organizations still have default credentials on network devices?

Default credentials persist due to a combination of factors: lack of mandatory credential change procedures in device deployment checklists, large numbers of devices deployed without dedicated IT security staff oversight, organizational turnover that loses institutional knowledge of which devices have been hardened, and in some cases deliberate vendor choices that enable easy initial setup at the cost of security. Solving this requires mandatory policy enforcement and compliance verification, not just awareness.

What was the most widely exploited edge device vulnerability in Ukraine?

MikroTik RouterOS vulnerabilities have been among the most exploited in Ukraine given MikroTik's broad deployment. Fortinet FortiGate SSL-VPN vulnerabilities (including CVE-2022-40684 and earlier) were exploited by multiple groups. Cisco Smart Install misconfigurations and IOS-XE web management vulnerabilities were also widely exploited across Ukrainian networks in documented campaigns.

How does Shodan help defensive security teams?

Defensive security teams use Shodan to monitor their own organizations' attack surface from an attacker's perspective—discovering what services and devices are visible on the internet, identifying exposed management interfaces that should be restricted, and finding legacy devices that may have been forgotten but remain internet-connected. SSSCIP uses Shodan monitoring at national scale to track Ukrainian government internet exposure metrics.

Can compromised routers be detected by the organizations using them?

Detection of router compromise from within the organization is difficult because the compromised device controls its own logging and can filter monitoring data. Detection is more reliable from external vantage points: out-of-band configuration comparison against known-good baselines, firmware integrity checks from a physically separate management channel, or behavioral network analysis from upstream provider visibility. Periodic physical console access for integrity checks is the most reliable method for high-security environments.

What is the Fortinet CVE-2022-40684 vulnerability and its Ukraine impact?

CVE-2022-40684 was a critical authentication bypass vulnerability in Fortinet FortiOS/FortiProxy/FortiSwitchManager that allowed unauthenticated access to management interfaces. Multiple threat actors including Russian-linked groups exploited this vulnerability against Ukrainian and international targets immediately after public disclosure in October 2022. Organizations with unpatched FortiGate devices exposed to the internet were subject to unauthorized admin account creation and configuration modification.

Sources

1. CERT-UA — "Advisories on Router and Network Perimeter Security," cert.gov.ua 2022-2024
2. NSA/CISA — "Hardening Network Devices: Best Practices for Critical Infrastructure," 2023
3. Fortinet — "CVE-2022-40684 Security Advisory," fortinet.com 2022
4. MikroTik — "RouterOS Security Hardening Guide," help.mikrotik.com
5. Shodan — "Ukrainian Critical Infrastructure Attack Surface Report," (reference via SSSCIP)