A survey by Trilix uncovered a significant vulnerability in a wireless router commonly used by SMBs. The vulnerability is in a device from a vendor – with a large user base around the globe – that CISA (Cybersecurity and Infrastructure Security Agency) previously observed PRC-sponsored actors exploiting. Edge devices, like routers, exist at the boundary between internal and external networks, making them a key target for cybercriminals and threat actors. Attacks on these devices can quickly lead to a compromised network and, ultimately, a data breach.

The survey further reveals that 200,000 devices with the vulnerability are currently exposed on the internet – and could be exploited without required interaction. This is immensely concerning, considering the attack can lead to a complete compromise of the device, allowing for a network breach and unauthorized access to internal resources.

According to RiskRecon, during 2020 and 2021, data breaches at small businesses globally jumped 152%, while during the same time period breaches at larger organizations rose 75%. Just like a contractor wouldn’t use the same tools, techniques, and tactics to dig a post hole as they would for a swimming pool – malicious actors adjust what they target to ensure they effectively compromise the vast landscape of small business.

Recently CISA released an advisory about the People's Republic of China state-sponsored exploitation of network devices typically used in Small Office and Home Office (SOHO) settings. Included in this list is CVE-2020-8515, related to a DrayTek small business router.

Edge devices themselves, such as routers and firewalls are rather uninteresting, however these devices are the gateway that protect the soft underbellies of companies. Once compromised, it's the open doorway into the rest of a network that is enticing for the adversary to perform the same level of research a team performs. A compromised edge device can le.