Hacker News Reader

From my CCNA days I seem to recall that this protocol is a local one and would require a break into another host on the network.

Though the diagram shows the core switch directly connected to the internet instead of having an external router connect to the internet - which was the design CISCO suggested back when in did my CCNMA evening class

View on HN

The article does not suggest that devices can be attacked from the internet. The threat is VLAN hopping or lateral movement. That illustration is oversimplified.

I was being generous :-))))))) though maybe if some PFY had let the management interface exposed to the internet but that is a worse problem I feel.

I read through it - it doesn't seem like VLAN hopping would really be possible unless you can straight up get into the control plane and change the port configuration. Thats at least 2-3 more steps from "RCE" basically.

Or a compromised L2 VPN endpoint

Reply on news.ycombinator.com