Never put a management interface on the internet
Palo Alto firewalls are being taken over through their admin web pages. The fix is the same one every time.
Yesterday Palo Alto Networks confirmed attackers are exploiting two bugs in the management web interface of its firewalls: one skips authentication, the other gives root. Thousands of these admin pages were reachable from the internet.
Different vendor, same story every few months. The device is fine at its job. Its admin page is the hole.
The rule I give every client:
- No admin interface on the internet. Firewall, VPN, router, switch, storage, hypervisor, printer. None.
- Reach them only from a management network or through a VPN, from a few named machines.
- Allow-list the source IPs on the device itself as a second layer.
- Check from outside. Scan your public IPs for ports 443, 8443, 4443 and the vendor’s admin ports. Search engines like Shodan already did.
When the next bug comes, and it will, an interface nobody can reach turns an emergency into a normal patch day.