Public reporting from CISA says state-sponsored actors often get in through internet-facing routers, VPNs and firewalls, using known or unknown flaws. A short checklist helps: inventory every edge device, patch fast, remove stored credentials, limit management access and retire unsupported hardware.
What the advisory says
CISA's Volt Typhoon advisory, issued with the NSA, the FBI and partner agencies on 7 February 2024, says the group gets in mainly by exploiting known or zero-day flaws in routers, VPNs and firewalls, then connects through VPN. In one case it exploited CVE-2022-42475 on an unpatched FortiGate. It also obtained credentials that were stored insecurely on appliances, and the advisory says plainly: "Do not store credentials on edge appliances/devices."
The advisory lists appliances from several vendors as frequent targets and recommends prioritising critical vulnerabilities in them.
Why edge devices are attractive
They sit on the boundary, run all the time and often have weak logging. Many are managed by a different team from the one that manages servers. Few run endpoint agents.
The checklist
Inventory. List every device that faces the internet: VPN gateways, firewalls, load balancers, routers, remote access appliances. If a device is not on the list, nobody patches it.
Patch. Set a target time for critical fixes on these devices. Know who is allowed to approve an emergency change.
Credentials. Check device configurations for stored passwords, keys or service account secrets. Remove or replace them with scoped, short-lived credentials where the device supports it.
Management access. Put admin interfaces behind a separate network path. Do not expose them to the internet. Use phishing-resistant MFA for administrators, as the advisory recommends.
Logging. Keep application, access and security logs turned on and send them to a central store, which the advisory also recommends.
Lifecycle. Know the end of support date for each device. The advisory advises planning for end of life of technology beyond the manufacturer's supported lifecycle.
Remote access software. Limit RDP use and disable SMBv1, as the advisory recommends, and review other remote access tools you run.
Review the device, not just the CVE
A patch fixes one flaw. If an attacker was already in, the device may still hold changed settings, added accounts or stolen credentials. After a critical edge patch, check configuration and accounts, and rotate secrets the device held.
A monthly ten minute routine
- Compare your edge inventory with a fresh external view of your addresses.
- Check the vendor's advisory page for each product.
- Confirm last patch dates.
- Sample one device's config for stored secrets.
Quick check
Is patching enough for an edge device?
It is necessary but not sufficient. Check for stored credentials, unexpected accounts and changed configuration, especially after a known exploited flaw.
Who should own edge devices?
One named owner per device, with a backup. Unowned devices are the ones that go unpatched.
Sources
Last reviewed: 19 October 2026.
