Keep your network kit's admin pages off the internet

This week's news has a familiar shape. Barracuda fixed two flaws that can be chained to get root, but only if an attacker can reach the admin interface. Cisco is patching an exploited firewall bug in its SSL VPN. Old Synology boxes are being encrypted. The common thread is simple: the page you use to manage a device is the page attackers want to reach. Here's how I think about keeping it out of their way.

Why the admin page matters so much

A firewall, switch, NAS or Wi-Fi controller has two jobs. It does its normal work, like passing traffic or storing files, and it has a management side where you log in and change things. The management side is powerful by design. If an attacker gets in there, they don't need to break anything else.

Barracuda's latest advisory makes this clear. It fixed a pre-authentication bypass in Email Security Gateway (CVSS 9.3) and a command injection flaw (CVSS 8.6) in several products. Chained together, they could give an attacker root. But Barracuda says the attacker needs access to the administrative interface, and its own advice is to limit that interface to trusted internal networks. Devices whose admin pages aren't on the internet are much less exposed to this attack.

The scale of the problem

When Cisco confirmed attacks on CVE-2026-76418, a flaw that lets an unauthenticated attacker crash ASA and Firepower Threat Defense devices running SSL VPN, Shadowserver was tracking more than 51,000 Cisco ASA SSL VPN devices online. A VPN has to be reachable, so that one is harder to hide. That's exactly why the parts that don't need to be reachable, the admin pages, should not be.

The NCSC's Annual Review, published this week, says many successful attacks still use basic weaknesses, and unpatched internet-facing systems are near the top of its list.

What "off the internet" means in practice

The US government gave its agencies a useful definition in CISA's Binding Operational Directive 23-02. It covers the management interfaces of routers, switches, firewalls, VPN concentrators, proxies, load balancers and out-of-band server management like iLO and iDRAC, when they can be reached from the public internet over HTTP, HTTPS, SSH or RDP. Agencies must either make those interfaces reachable only from an internal network, ideally a separate management network, or put them behind an access control point that is separate from the device itself.

That's a good standard for any business, not just a US agency. In plain terms:

Turn off WAN-side management on firewalls and routers unless you have a written reason to keep it.
Use a management VLAN for switch, access point and controller admin addresses, and only allow your admin machines to reach it. The NCSC's guidance on network devices strongly recommends a separate management network for admin tasks.
Reach it remotely through something else: a VPN, a cloud management portal with MFA, or a jump box. The device's own login page should never be the front door.
Lock down server remote access too. RDP and iLO count. On Windows Server you can limit the Remote Desktop firewall rules to a management subnet. Today's tutorial walks through it.

UniFi and other cloud-managed kit

Cloud-managed networks like UniFi change the picture a little. You often manage them through a vendor portal rather than a page on the device, which helps. But the console itself still has a local admin page and often SSH. The same rules apply: keep those on a management network, use strong, unique admin credentials with MFA on the cloud account, and don't port-forward anything to the console. Check that SSH is off on devices where you don't use it.

Patching still comes first

Hiding an admin page lowers the risk. It doesn't remove it. Someone already on the network, or a compromised laptop, can still reach a management VLAN if the rules are loose. So the order of work is:

Patch the firmware. Barracuda warns that devices several versions behind may need more than one update.
Remove internet access to admin pages, or put it behind a VPN or separate access control.
Restrict who can reach the management network from inside.
Log admin logins, and alert on logins from places you don't expect.

A quick check you can do this week

Make a list of every device with a web admin page: firewalls, switches, controllers, NAS boxes, printers and server management cards. For each one, write down whether its admin page is reachable from the internet, and how you reach it remotely. If the answer to the first question is "yes" or "not sure", that's your list to fix. An outside port scan of your own public IP addresses is a good way to check you haven't missed one.

None of this is new or exciting. But the attacks this week keep working because admin pages are still sitting on the internet, so this is one of the most useful hours you can spend on a network.

Sources

← All posts