An attacker doesn’t need a clever zero-day to get into your network anymore. They just need the login page on the box you bought to keep them out. Over the past several weeks, large-scale credential attacks have hammered the edge devices from major security vendors, and when the password spray lands or an unpatched flaw gives way, the payoff isn’t a low-privilege foothold. It’s root. The appliance you trusted to enforce your cybersecurity posture becomes the launch pad for everything that follows.

That’s the uncomfortable shape of the current threat landscape. The perimeter gear sold as protection is now the most-attacked credential surface you own.

The Devices Selling You Safety Are The First Ones Hit

Unit 42 published guidance this week on preparing for large-scale credential attacks, and the detail worth sitting with is the targeting. These campaigns are zeroing in on security vendors’ own devices: VPN concentrators, firewalls, identity gateways, the management planes that sit right on the internet because they have to.

Think about why that’s attractive. A firewall’s admin interface is a single door that, once open, hands you the keys to traffic inspection, routing, and often the internal network behind it. Attackers run brute-force and password-spray at scale against these endpoints precisely because the reward-to-effort ratio is absurd. One reused admin credential, one device still running a factory default, one account that survived an employee’s departure, and they’re in.

The campaigns aren’t probing random servers. They’re concentrating firepower on the management interfaces of the exact products meant to stop them.

The brutal part is that none of this requires sophistication. Credential attacks succeed without an exploit. They succeed because the login still works, and because the device’s threat detection often isn’t watching its own front door with the same intensity it watches yours.

Credentials Get Them In. A Flaw Gets Them Root.

Credential pressure is only half the squeeze. The other half is what happens when a vulnerability on the same class of device turns a foothold into total control.

Look at the Cisco situation playing out right now. CISA set an urgent deadline for federal agencies to patch a flaw in Cisco Unified Communications Manager that’s being actively exploited, giving them until Sunday to fix it. Around the same time, SentinelOne’s week-26 roundup flagged attackers exploiting Cisco flaws to gain root access outright. Same vendor, same pattern: edge and management systems under live attack, with privilege escalation as the prize.

Stack the two threats and you get the real picture. Credential attacks knock on every door at once. Exploited vulnerabilities blow a door off its hinges. Either path lands an adversary on a device that already has deep network trust, and from there the brute-force noise stops mattering because they no longer need to guess anything.

This is why treating “patched” and “secured” as the same state gets teams burned. A device can be fully patched and still fall to a sprayed credential. It can have strong passwords and still fall to an unpatched CVE. Defense in depth exists because no single control on these boxes holds alone.

Close The Window Before The Next Wave Hits

You can’t stop attackers from pointing their tooling at your edge. You can make the front door boring, slow, and loud enough that it isn’t worth their time. Here’s where to spend effort, starting today.

Immediate actions, this week:

• Pull every management interface off the open internet. Put admin access behind a VPN, a jump host, or source-IP allowlists. If an attacker can’t reach the login page, the brute-force campaign never starts.
• Patch the actively exploited stuff first. Cross-reference your edge inventory against CISA’s Known Exploited Vulnerabilities catalog and treat anything on it as an emergency, not a maintenance-window item. The Cisco deadline is a calendar you should be keeping too.
• Kill default and shared admin accounts. Rotate every device credential, enforce phishing-resistant MFA on management logins, and confirm no account survived its owner’s offboarding.
• Turn on brute-force throttling and lockouts at the device and identity layer so password spraying hits a wall instead of an open field.

Ongoing, so the gains stick:

• Ship appliance auth logs off the box. If the device is compromised, its local logs are the first thing edited or wiped. Forward authentication events to a SIEM where failed-login spikes and impossible-travel patterns surface on their own.
• Build alerts for the device’s own front door. A surge of failed admin logins, a successful login from a new geography, or a config change outside a change window should page someone. That’s threat detection pointed inward, where it’s usually weakest.
• Maintain a real inventory of internet-facing security gear, with an owner per device. You can’t harden or patch what nobody is named to watch.
• Rehearse the appliance-compromise scenario. Your incident response plan should answer one question fast: if the firewall itself is owned, how do we detect it, isolate it, and rebuild trust? Practice that before you need it.

Security hardening on these devices isn’t a one-time checklist. The campaigns are continuous and automated, so your controls have to be too.

The thread running through all of this is simple and a little grim. Attackers have figured out that the cheapest way past your defenses is through the defenses themselves. The firewall, the VPN, the unified comms server, all the gear with privileged reach and an internet-facing login. Brute-force the credentials or exploit the flaw, and root is waiting on the other side. Treat those boxes like the high-value targets they’ve become, because the people knocking on their login pages already do.

Sources

• Threat Brief: Mitigating Large-Scale Credential Attacks
• CISA sets urgent deadline to fix Cisco flaw exploited in attacks
• The Good, the Bad and the Ugly in Cybersecurity – Week 26