Outdated VPN Appliance and a Crash Risk

Default answer: no, not during business hours without a maintenance window. Decision criteria: (1) availability impact-60% exploit reliability and possible reboot means a meaningful chance of taking 800 remote workers offline; (2) scope-rules say no DoS and production must stay available; (3) exploit maturity-if the CVE is pre-auth RCE and public, the risk is real, but proof can often be obtained non-destructively; (4) client intent-the CISO wants proof, but operations owns availability.

First steps: verify the exact firmware version from the login page or an unauthenticated endpoint, match it to the vendor advisory, check whether the vulnerable endpoint is exposed, and look for a safe detection method (version string, error message, or configuration leak). I would document the finding as 'vulnerable version exposed' with the CVE and business context, then request a maintenance window for a controlled exploitation attempt. If the client insists on immediate proof, I would ask for written authorization that acknowledges the reboot risk and have the operations team on standby. I would not run a public exploit blindly.

Use a controlled request to a non-sensitive endpoint that returns a stack trace, and stop as soon as you see the error. Capture only the response headers, status code, and a redacted snippet showing the exception class and file path. Do not enumerate object IDs, do not attempt SQL injection, and do not pull customer records. If the stack trace reveals a database connection string, redact the password and note only that a secret is exposed. Send one request, not a fuzzing run. Document the exact request, timestamp, and redaction. The judgement is that the vulnerability is the information leak, not the data itself; proving the leak does not require extracting data. If the error page includes PII, stop and notify the client immediately.

Severity: Critical, with a caveat. Rationale: the appliance is internet-facing, the vulnerability is pre-auth RCE, and public exploit code exists. That gives a remote unauthenticated attacker a path to network access. Business impact is high because the VPN terminates 800 remote workers, and a compromise could lead to credential theft or lateral movement into production. The caveat is that exploitation reliability is 60% and may reboot the appliance, so the risk includes availability loss. Compensating controls-MFA on VPN, network segmentation, and EDR-reduce but do not eliminate impact. The finding should state: 'An unauthenticated attacker could exploit CVE-XXXX to execute code on the VPN appliance. Successful exploitation may also cause a reboot, disrupting remote access for up to 800 users. We did not exploit the issue because of the availability risk; we confirmed the vulnerable version and exposed endpoint.' Remediation: patch within 72 hours, or restrict access to the management interface and enable vendor mitigations.