The Guest Wi-Fi That Reaches the Printers
A hospital adds guest Wi-Fi for patients. The guest SSID is on a separate VLAN, but the guest VLAN is configured as a subinterface on the same core switch as clinical VLANs, and the only segmentation is an ACL on the core switch that blocks guest-to-clinical traffic by subnet. A penetration test finds that a guest device can reach a networked printer in a clinical VLAN by using the printer's link-local IPv6 address, which the ACL does not cover because it matches only IPv4 subnets. The printer is reachable and exposes an unauthenticated web admin page. Clinical staff also use the same printer VLAN for medical device management.
1. Why did the subnet-based ACL fail, and what class of weakness is this?
Read the worked answer
The ACL matched only IPv4 subnets, so IPv6 link-local traffic (fe80::/10) bypassed it entirely. The guest VLAN shared L2/L3 infrastructure with clinical VLANs and relied on a single L3 filter for isolation. This is a segmentation-by-filter weakness: isolation is enforced by policy on shared infrastructure rather than by topology, so any protocol or address family the filter doesn't model becomes a bypass. The printer's unauthenticated admin page turns a reachability gap into an exploitation path, and the shared printer/medical-device VLAN widens the blast radius.
2. Recommend a segmentation fix and a defense-in-depth control for the printer, and explain why both are needed.
Read the worked answer
Segmentation: move guest traffic onto dedicated infrastructure or a firewall-enforced zone (separate physical/VLAN domain with a stateful firewall, not a switch ACL), and explicitly deny/allow both IPv4 and IPv6 - including link-local - with default-deny between zones. Put medical-device management on its own VLAN separate from the printer. Defense-in-depth: disable or authenticate the printer's web admin, restrict management to a management VLAN, and disable unnecessary services. Both are needed because topology segmentation reduces reachability but misconfigurations recur; hardening the device means a future segmentation gap does not immediately yield an exploitable admin interface. The lesson: model all address families and protocols, and don't let a filter be the only wall.