UNIT 42
The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
MEDIUM WSUS brute-force VPN third-party-risk
Strategic summary
The case shows that a months-long, technically simple attack via VPN brute-force and a WSUS RCE can succeed when foundational identity and software-distribution controls are weak.
Relevance for you
The case shows that a months-long, technically simple attack via VPN brute-force and a WSUS RCE can succeed when foundational identity and software-distribution controls are weak.
Risk score
0
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 0.50
- exploitability factor
- 1.00
- days old
- 25.00
- vendor mismatch penalty
- 0.00
- consensus penalty
- -5.00
Path: operational
Consensus check
The pipeline self-checks before delivery. These rules lowered the score:
-
VENDOR_MISMATCHVendor not found in alert title −5
- Consensus penalty:
- −5.0
- Total penalty:
- −5.0