The deadliest network attacks, and how to close each one
The first four are inside the LAN: defaults that let one port reach much too far.
The last six face the Internet: VPNs and management interfaces, and all six are in CISA's catalog of exploited vulnerabilities.
VLAN hopping
A port that negotiates itself into a trunk, or a frame with two tags, and every VLAN is in reach.
Close it: access mode on user ports, no trunk negotiation, and a native VLAN nobody uses.
STP manipulation
Every vendor ships the same priority, 32,768, so a device on a desk can claim to be the root.
Close it: BPDU Guard on user ports, and Root Guard toward access switches.
MAC flooding
Fill the switch's address table, and it sends frames for other hosts to every port.
Close it: port security, with a limit on addresses per port.
Rogue DHCP and ARP
The fake gateway. A rogue DHCP server or a spoofed ARP answer, and traffic flows through the attacker.
Close it: DHCP snooping and Dynamic ARP Inspection, trusting only your uplinks.
FortiOS SSL VPN
Three flaws, all exploited and all used by ransomware, and VPN access details for 87,000 devices disclosed.
Close it: patch, reset VPN passwords, and turn on two-factor authentication.
PAN-OS
Code as root on the firewall, without logging in, scored 10.0.
Close it: patch, and keep the management interface off the Internet.
Cisco management services
Smart Install, the web interface and SNMP, left listening, and still used by state actors.
Close it: no vstack, no ip http server, and an access list on every SNMP community.
Juniper J-Web
Four medium flaws that chain into code execution, with no login.
Close it: patch, and disable J-Web or limit it to trusted hosts.
MikroTik Winbox
One open port, and the router hands over its user database.
Close it: upgrade, change every password, and firewall Winbox from the Internet.
F5 BIG-IP
The management API skipped authentication, on a box that sits in front of every application.
Close it: patch, lock down the self IPs, and keep management on trusted networks.
In short
Ten doors, each with its own page, the commands for each vendor, and the official sources.
The episodes so far
VLAN hopping
VLAN hopping through trunk negotiation and double tagging, what it gives an attacker, and the settings that close it on four vendors.
Episode 2STP manipulation
How a rogue device becomes the spanning tree root, what that costs the network, and how BPDU Guard and Root Guard prevent it.
Episode 3MAC flooding
When a switch's MAC table overflows, it floods every frame out of every port. Why that matters, and the per-port limits that stop it.
Episode 4Rogue DHCP and ARP
The fake gateway, through a rogue DHCP server or ARP spoofing, and how DHCP snooping and Dynamic ARP Inspection close it off.
Episode 5FortiOS SSL VPN
CVE-2018-13379, CVE-2022-42475 and CVE-2024-21762 on the FortiOS SSL VPN: how easy, what impact, and the steps that close them.
Episode 6PAN-OS
GlobalProtect and the PAN-OS management interface: three CVEs in CISA's catalog, their impact, and the measures that close them.
Episode 7Cisco management services
Smart Install, the IOS XE web UI and SNMP: the Cisco management services attackers still use, and how to switch them off safely.
Episode 8Juniper J-Web
Four medium J-Web flaws on Junos that chain into a critical one (CVE-2023-36845), what the chain gives, and the steps that close it.
Episode 10F5 BIG-IP
CVE-2022-1388 on the F5 BIG-IP iControl REST API: commands with no login on the box that sits in front of every application.
Episode 11PHP2Shell
CVE-2026-109618 and CVE-2026-109619 in PHP's core, from 5.4 to 8.5.11: what they allow, and the releases that fix them.
Episode 12FortiSIEM
CVE-2026-106173 on the FortiSIEM phQueryMaster service: one reachable port is enough to become root. The releases, and the step that closes it.
Episode 13GitLab
CVE-2026-110264, an integer overflow in GitLab's regular expression engine, scored 10.0: the impact, and the fixed releases.
Episode 14CDPwn
CVE-2020-3118 and four more Cisco Discovery Protocol flaws on IOS XR, NX-OS, IP phones and cameras: the impact, and what closes them.
Sources
Sources: CISA KEV, vendor advisories (Fortinet, Palo Alto Networks, Cisco, Juniper, MikroTik, F5, PHP, GitLab), NVD, CISA and FBI advisories, vendor configuration guides.
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.