Network Device Pentest

---
name: network-device-pentest
description: "Use when testing network devices and appliances — routers, switches, firewalls, VPN concentrators, load balancers, wireless controllers, and management planes (Cisco, Juniper, Fortinet, Palo Alto, MikroTik, etc.). Covers management-interface exposure, default/weak credentials, insecure protocols, firmware/CVE exposure, SNMP, and configuration review. Authorized engagements only."
---

# Network Device & Appliance Testing

Security assessment of network infrastructure devices and their management planes. These devices are high-value: compromise often yields traffic visibility, pivot points, or full network control.

## 0. Authorization gate
- [ ] Written scope naming devices/management IPs and change-freeze rules.
- [ ] Explicit caution: config changes can cause outages — read-only unless cleared.
- [ ] Backup/rollback plan and emergency contact confirmed.

## 1. Management-plane exposure
- Identify management interfaces reachable from untrusted networks: web UI, SSH/Telnet, SNMP, API, and vendor management protocols.
- **Finding pattern:** management plane exposed to user/internet zones.
- **Fix:** dedicated management network/VLAN, ACLs, no internet-facing admin.

## 2. Authentication
- Default/weak credentials, shared local accounts, no MFA, legacy auth.
- Credential reuse across devices.
- **Fix:** unique strong creds, centralized AAA (TACACS+/RADIUS) with MFA, disable unused local accounts.

## 3. Insecure protocols & services
- Telnet, HTTP admin, SNMPv1/v2c with default community strings, legacy SSL/TLS, unauthenticated discovery protocols.
- **Fix:** SSH/HTTPS only, SNMPv3, disable unused services and discovery protocols on untrusted interfaces.

## 4. Firmware & known vulnerabilities
- Identify model + firmware version; map to vendor advisories/CVEs (VPN and firewall appliance CVEs are frequently exploited in the wild).
- **Fix:** patch/upgrade cadence, subscribe to vendor advisories, retire EoL hardware.

## 5. Configuration review (high value, low risk)
- Review running config for: weak SNMP, permissive ACLs/rules, any-any firewall rules, insecure management, logging gaps, weak encryption, unused open services, default settings.
- Map firewall rule base against intended segmentation.
- **Fix:** least-privilege rule base, tightened ACLs, logging to SIEM, config hardening per vendor/CIS benchmark.

## 6. Tooling
nmap (service/version), snmpwalk/snmp-check, ssh-audit, vendor CVE databases, config-analysis (manual + benchmark tools). Prefer configuration review over live exploitation to avoid outages.

## 7. Reporting
Per finding: device, interface/exposure, severity, business impact (traffic interception / pivot / outage risk), remediation. Emphasize management-plane isolation and patching. Checklist: `references/device-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>