Scanning the open internet is a blunt instrument, but it is honest. A device either answers on a port or it does not. Across the address space we sample, roughly seven in ten reachable IoT and embedded devices are running firmware with at least one published vulnerability. In the majority of those cases, a patch has existed for more than a year.
That statistic gets quoted a lot without the part that matters: the exposure is extremely concentrated. Five ports account for most of what an attacker can reach, and four of the five exist for remote administration.
Where the exposure actually sits
- 23/tcp: Telnet, still enabled by default on a surprising amount of cheap networking hardware.
- 554/tcp: RTSP camera streams, frequently unauthenticated.
- 7547/tcp: TR-069 remote management, historically a mass-exploitation favourite.
- 22/tcp: SSH, usually fine, occasionally still on vendor defaults.
- 80/tcp: the device’s own admin panel, published to the world by a helpful UPnP rule.
None of that requires a sophisticated adversary. It requires a scan, a default credential list, and patience. For an organisation whose threat model includes a well-resourced state actor, the uncomfortable truth is that the first door tried will be the cheapest one.
The device that compromises you is almost never the one you were worried about. It is the one you forgot you owned.
What to do about it this week
Inventory first. You cannot patch what you cannot name, and most small organisations discover during an incident that their network holds two or three devices nobody can account for: a camera from a previous office, a router a volunteer installed, a printer with a web server on it.
- List every device with an IP address, including the ones that arrived with the building.
- Close remote administration at the network edge. If it must be remote, put it behind a VPN.
- Change every credential that was ever a default, and record where it now lives.
- Set a calendar reminder to repeat the inventory quarterly. It will drift.
Zeroth Cloud does this continuously for the platforms it protects: it watches what is reachable, flags what is known-vulnerable, and applies the fix where it safely can. The point is not that the work is hard. The point is that nobody on a three-person team has time to do it every quarter, forever.