Top 10 Network Security Misconfigurations

Attackers rarely need a zero-day to get into a network when an internet-facing admin page, a default password or a forgotten VPN account will do. The same network misconfigurations recur in ransomware intrusions and state-sponsored espionage alike. This list ranks ten by our judgement of how often they are exploited and the damage they enable, drawing on NSA and CISA advisory AA23-278A, CISA's directive on exposed management interfaces and joint hardening guidance for communications infrastructure. It is for network engineers, security architects and the teams who audit them.

The Top 10 at a glance

1. Any/any and overly permissive firewall rules
2. Management interfaces exposed to the internet
3. Default and shared credentials on network devices
4. Flat networks without segmentation
5. Cleartext and legacy management protocols
6. Unpatched edge devices
7. Stale VPN accounts and remote access without MFA
8. No egress filtering
9. Missing network logging, flow data and change monitoring
10. Weak Wi-Fi configuration

1. Any/any and overly permissive firewall rules

The misconfiguration: any source to any destination on any port, "temporary" rules from long-finished projects and inbound allows from 0.0.0.0/0 to whole subnets.

Why it matters: every unnecessary allow is reachable attack surface. Attackers scan for open services (T1046 Network Service Discovery) and, once inside, add their own rules (T1686 Disable or Modify System Firewall) that disappear among thousands. AA23-278A lists "Insufficient access control lists (ACLs) on network shares and services" among its ten.

The fix: deny by default, an owner and expiry date on every rule, hit-count reviews to remove unused rules, and change checks that block any/any. See the Firewall Management Guide.

2. Management interfaces exposed to the internet

The misconfiguration: web consoles, SSH, Telnet, SNMP or out-of-band controllers (iLO, iDRAC) on routers, switches, firewalls, VPN concentrators and load balancers reachable from the internet.

Why it matters: CISA's Binding Operational Directive 23-02 (13 June 2023) states that "Threat actors have used certain classes of network devices to gain unrestricted access to organizational networks." Exposed interfaces invite brute force (T1110) and are exploited first when a device flaw is published (T1190).

The fix: BOD 23-02 gives federal agencies 14 days to either remove such interfaces from the internet or put them behind a Zero Trust access control point separate from the interface itself (the preferred option). The joint telecoms guidance is blunter: "Do not manage devices from the internet." Use an out-of-band management network, restrict VTY lines with ACLs and scan your own address space. See the ZTNA Guide and the Attack Surface Management Guide.

3. Default and shared credentials on network devices

The misconfiguration: devices left with factory admin passwords, one shared "admin" login across the estate, local accounts stored with weak password types and SNMP community strings such as "public" and "private".

Why it matters: AA23-278A notes that manufacturers ship network devices with "predefined default credentials for their built-in administrative accounts". In the Salt Typhoon telecom intrusions, Cisco Talos found device configurations holding SNMP read/write community strings and local passwords with weak encryption, recoverable offline. Vendors ship the same flaw as hard-coded credentials, as in the HPE Aruba Instant On access points.

The fix: "Ensure that no default passwords are used." Route device logins through central AAA (TACACS+ or RADIUS) with MFA, kept separate from the corporate identity store, plus one vaulted break-glass account per device. Use Type-8 password hashing on Cisco devices rather than Type-5 or Type-7. Vault and rotate SNMP secrets and TACACS+ or RADIUS shared keys as machine credentials. See the Secrets Management Guide.

4. Flat networks without segmentation

The misconfiguration: users, servers, management interfaces, OT and guests on one routable network with no filtering between them.

Why it matters: in the advisory's words, "Lack of network segmentation leaves no security boundaries between the user, production, and critical system networks." One phished laptop can then reach domain controllers, backups and hypervisor consoles over remote services (T1021).

The fix: segment by function and sensitivity, filter between segments by default-deny, put administration on dedicated networks and workstations, and microsegment high-value workloads. Start with backups, identity systems and management planes. See the Network Segmentation Guide.

5. Cleartext and legacy management protocols

The misconfiguration: Telnet (TCP 23), HTTP admin pages, SNMPv1 and SNMPv2c (UDP 161 and 162) with community strings, TFTP (UDP 69) for configuration backups, and legacy features such as Cisco Smart Install left enabled.

Why it matters: anything sent in cleartext can be captured (T1040 Network Sniffing), and device configurations pulled over SNMP or TFTP hand attackers credentials and network maps (T1602 Data from Configuration Repository). Talos reported that Salt Typhoon exfiltrated configurations over TFTP and FTP and captured SNMP, TACACS and RADIUS traffic, including shared secrets. In one case it likely abused the Smart Install flaw CVE-2018-0171.

The fix: the joint guidance says "Disable telnet and ensure it is not available on any of the VTY lines" and to "ensure only SNMP v3 with encryption and authentication is used". Use SSH, HTTPS and SFTP or SCP for configuration transfer, and disable Smart Install (no vstack) and every other unused service. See the Network Ports and Protocols Security Guide.

6. Unpatched edge devices

The misconfiguration: VPN gateways, firewalls and application delivery controllers months behind on firmware, owned outside vulnerability management or past end of support.

Why it matters: edge devices face the internet, rarely run endpoint detection and hold credentials and sessions. In the Ivanti Connect Secure exploitation, two chained zero-days (CVE-2023-46805 and CVE-2024-21887) compromised more than 1,700 devices within days, and CISA warned that stored user and service account credentials were likely compromised. CitrixBleed (CVE-2023-4966) leaked session tokens that let attackers bypass MFA, so patching without killing sessions was not enough.

The fix: include every edge device in asset inventory and vulnerability scanning, patch internet-facing devices first against CISA's Known Exploited Vulnerabilities catalogue, replace end-of-support devices, and after a compromise reset sessions and every credential the device stored. See the VPN Security Guide and the Zero-Day and Exploited Vulnerabilities Guide.

7. Stale VPN accounts and remote access without MFA

The misconfiguration: VPN profiles for leavers, contractors and old projects never disabled, local VPN accounts outside the identity provider, and password-only remote access.

Why it matters: valid credentials on external remote services (T1133, T1078) look like normal logins. In the Colonial Pipeline ransomware attack, a legacy VPN profile that was no longer used, had never been disabled and had no MFA let DarkSide in, and the pipeline was shut for six days. AA23-278A also warns that "Some forms of MFA are vulnerable to phishing."

The fix: tie VPN access to the identity provider so leavers lose it automatically, disable accounts after at most 45 days of inactivity, and require phishing-resistant MFA. Where you can, replace network-level VPN access with per-application access. See the Remote Access Identity Guide.

8. No egress filtering

The misconfiguration: servers and devices allowed to open any outbound connection to any destination, and DNS resolvable from anywhere to any resolver.

Why it matters: most malware needs to call home and most data theft needs a way out (T1048 Exfiltration Over Alternative Protocol). Without outbound controls, a compromised server reaches command and control and uploads data unnoticed.

The fix: default-deny outbound from server and management segments, route user web traffic through a proxy, force DNS through internal or protective resolvers, and alert on denied outbound attempts from servers. See the DNS Security Guide.

9. Missing network logging, flow data and change monitoring

The misconfiguration: device logs kept only locally, no flow data (NetFlow or IPFIX) at boundaries, and no alert when a device configuration changes.

Why it matters: "Insufficient internal network monitoring" is one of the ten in AA23-278A, which describes an organisation that could see infected hosts but not the source of infection. Attackers who reach network devices clear logs and connection history (T1685, T1070.007), and Talos reported that Salt Typhoon cleared logs and altered ACLs and AAA settings to keep access, in one case for over three years.

The fix: "Implement secure, centralized logging" with copies stored off-site, deploy flow monitoring at ingress and egress points, and compare running configurations with a golden copy held elsewhere: "Do not allow devices to be the trusted source of truth for their configuration." See the Log Management and Retention Guide.

10. Weak Wi-Fi configuration

The misconfiguration: corporate SSIDs on WPA2-Personal with a never-changed shared key, guest Wi-Fi bridged to internal networks, WPS left on and nobody looking for rogue access points.

Why it matters: a shared key leaks with every leaver and lets anyone in range join the internal network or sniff traffic (T1040).

The fix: WPA2-Enterprise or WPA3-Enterprise with 802.1X and certificate-based authentication for corporate devices, guest networks isolated to the internet only, WPS disabled, and wireless intrusion detection for rogue access points. See the Wi-Fi Security Guide and the Network Access Control (NAC) Guide.

Mapping to OWASP

Honestly, this list maps to OWASP only weakly. The OWASP Top 10 describes itself as "a broad consensus about the most critical security risks to web applications"; network infrastructure is out of scope. A02:2025 Security Misconfiguration, A07:2025 Authentication Failures and A09:2025 Security Logging and Alerting Failures share themes, not controls. Better maps are CIS Controls v8.1 Control 4 (Secure Configuration of Enterprise Assets and Software), Control 12 (Network Infrastructure Management) and Control 13 (Network Monitoring and Defense), and advisory AA23-278A, so we lead with those.

Where to start

If you can do only three things this quarter: take management interfaces off the internet and scan to prove it (misconfiguration 2), patch or replace edge devices against the KEV catalogue (6), and remove stale VPN accounts while enforcing phishing-resistant MFA (7). Then change every default credential, move device logins to central AAA (3) and turn off Telnet and SNMPv1/v2c (5). Track five numbers monthly: management interfaces reachable from the internet (target zero), edge devices with an overdue KEV-listed vulnerability (target zero), remote access accounts without MFA or unused for 45 days (target zero), devices still using Telnet or SNMPv1/v2c, and firewall rules without an owner or expiry date.

Primary sources: NSA and CISA advisory AA23-278A, CISA BOD 23-02, the joint Enhanced Visibility and Hardening Guidance for Communications Infrastructure, CIS Control 12 and Control 13, and the MITRE ATT&CK network devices matrix.

Related NHI Mgmt Group resources: Firewall Management Guide · Network Segmentation Guide · VPN Security Guide · ZTNA Guide · Network Ports and Protocols Security Guide