Who owns your edge equipment?

In July 2026, the NSA, CISA, the FBI, the U.S. Department of Defense Cyber Crime Center, and fifteen international partner agencies jointly attributed an ongoing campaign to Russian FSB Center 16 cyber actors. The advisory describes the actors as “opportunistically compromising multiple critical infrastructure sector networks” worldwide through poorly configured and vulnerable networking devices, not through a targeted campaign against any specific organization.

The technique matters more than the attribution. The actors’ primary method is scanning public IP ranges for devices running SNMP with default or common community strings still in place, the network equivalent of a lock nobody changed after moving in. Where a vulnerability is used instead of a default credential, the advisory names two: CVE-2018-0171, from 2018, and CVE-2008-4128, which the advisory notes affects end-of-life devices, from 2008. This is a state-sponsored actor succeeding against equipment that was never hardened after installation, not against a novel exploit. Nineteen government agencies co-sealing one advisory establishes that this is a coordinated, cross-border concern; it does not establish that any specific reader’s equipment has been touched.

The exposure is not exotic

A nation-state actor in the headline makes this sound like a problem only a large, targeted organization needs to worry about. The advisory describes the opposite: opportunistic scanning that finds whatever is reachable and unhardened, regardless of the size or profile of the organization behind it. The barrier the actors are clearing is a default password and a decade-plus-old CVE on unpatched equipment, not a sophisticated defense.

For a small or owner-led organization, this usually is not a device anyone thinks of as part of “the security program.” It is the router or firewall appliance that arrived from an ISP or was installed once by whoever set up the office network, and has not been looked at since.

Who actually owns this box

Ask a direct question: for every router, firewall, or other edge device your organization depends on, who has the administrative credentials, and when were they last changed from the default or from whatever was set at installation?

If the equipment is ISP-supplied, the ISP may hold the credentials, may have a support obligation, and may not proactively harden a device unless asked. If it was installed by an IT provider, confirm that hardening was part of the engagement rather than assumed. If nobody can answer who owns the configuration, that is the finding, independent of whether any specific CVE applies to the specific model in use.

A short list to check

• Is SNMP in use on the device, and if so, has the default or common community string been changed, or disabled in favor of SNMPv3 with authentication and encryption?
• Is the device’s firmware current, and is there a process for finding out when it is not?
• Who holds administrative access to the device, and is that access reviewed on any schedule?
• If the device is end-of-life, per CVE-2008-4128’s applicability, is there a plan to replace it, or a compensating control while it remains in service?

Match the response to what you find

If nobody can answer who owns the device, start there before evaluating any specific vulnerability. If ownership is clear but the last configuration review predates the device’s current firmware version, a scoped review of that one device is a reasonable next step. This is not a reason to replace working equipment on a fixed schedule; it is a reason to know, in writing, who is responsible for it and when it was last checked.

Our guide to what an MSP contract actually covers helps confirm whether edge-device hardening was part of what you purchased.