The advisory also labels a 9.3 severity rating as “high,” when 9.0 and above is actually “critical” on the standard scale, he pointed out. “These are small things, but labels drive patching queues,” he noted. Also, the advisory does not say whether these flaws are currently being exploited, but it does not say they are not, either.
How enterprises should respond
“Get the admin interface off the internet,” Dickson emphasized, noting that, as a cybersecurity consultant, he gives that advice at least a handful of times a week. “Management interfaces on edge devices are continually a source of vulnerability.”
Once teams limit admin access to a trusted internal network or a dedicated management network, Dickson advised, they should then “verify the patch rather than assume it was properly installed.” From there, he said, analyze for unauthorized visitors by reviewing admin logs, check for unfamiliar accounts, and look for unexpected outbound connections from the device.
