When the Guards Turn into Vulnerabilities

Imagine investing in security products only to find they’re giving hackers free reign over your network. This latest crisis isn’t just a fluke - it’s part of an alarming trend in security failures that aren’t doing the industry any favours.

“Grrr. Woof. Meh.”

7 min read  |  Reflare Research Team

The cybersecurity industry faces a crisis of confidence as Ivanti battles its second major security disaster in just over a year. The discovery of two new critical vulnerabilities in Ivanti Connect Secure appliances - with one already being actively exploited - represents more than just another set of CVEs. It exemplifies a devastating pattern where security products themselves become the weak link in an organisation's defences.

The irony is brutal: Ivanti Connect Secure, a product explicitly designed to protect networks by providing secure remote access, has instead become an attack vector. The critical vulnerability (CVE-2025-0282) allows unauthenticated remote code execution - essentially giving attackers the keys to the kingdom without even needing to pick the lock. Even more concerning, Mandiant's investigation revealed that attacks began in mid-December, meaning attackers had weeks of undetected access.

This isn't an isolated incident. The security product landscape is littered with similar failures:

Fortinet's FortiGate SSL-VPN

Fortinet's SSL-VPN products, meant to provide secure remote access, suffered multiple critical vulnerabilities. The most severe (CVE-2024-21762) allowed attackers to execute code without authentication, essentially turning these security appliances into potential backdoors. CISA had to add these vulnerabilities to their Known Exploited Vulnerabilities catalog, forcing federal agencies into emergency patching modes.

Palo Alto Networks' PAN-OS

A critical vulnerability in PAN-OS Management Web Interface (CVE-2024-0012) affected their next-generation firewalls, allowing attackers to execute code remotely. These firewalls, positioned as advanced threat prevention platforms, ironically became potential entry points for attackers.

F5 BIG-IP

F5's BIG-IP security products, used by numerous Fortune 500 companies, faced multiple critical vulnerabilities. The most severe allowed unauthenticated attackers to completely bypass security controls and take over the devices. These aren't just theoretical vulnerabilities - they were actively exploited in the wild.

The pattern is clear and deeply troubling. Security vendors, whose primary mission is to protect organisations, are repeatedly failing at their core function. What makes this particularly devastating is the privileged position these products hold within networks. When a security product fails, it doesn't just create a hole in the defense - it often provides attackers with elevated access and capabilities.

In Ivanti's case, the situation is particularly egregious. After their 2024 security issues, they promised a "secure-by-design development overhaul." Yet here we are, facing another critical zero-day with active exploitation.

The impact extends beyond immediate security concerns. Organisations invest heavily in these security products, both financially and in terms of operational reliance. When these products fail, the disruption is severe especially when organizations are being told to perform factory resets on their security appliances - a significant operational undertaking that could disrupt business operations.

The Evolving Threat Landscape

What's particularly concerning about these security product failures is their exploitation profile. The Ivanti vulnerabilities, for instance, show signs of being weaponized by advanced persistent threat (APT) groups. Mandiant's analysis linking some attacks to China-nexus groups suggests these vulnerabilities are being exploited in sophisticated, targeted campaigns rather than opportunistic attacks.

This targeting of security products by nation-state actors represents a significant shift in the threat landscape. These groups recognise that compromising security infrastructure provides far more valuable access than traditional attack vectors. It's a strategic choice that maximises their return on investment - why spend resources on multiple attack attempts when compromising a single security product can provide access to thousands of networks?

The Deeper Industry Problem

The industry faces a fundamental question: how can organisations trust security products when they repeatedly prove to be vectors for attack? The standard advice of "patch quickly" becomes almost satirical when the patches themselves are delayed, as in the current Ivanti scenario where some products won't receive updates for weeks.

Part of the challenge lies in the development practices of security vendors themselves. The pressure to release new features and maintain competitive advantage often leads to rushed development cycles and inadequate security testing. This is particularly ironic given that these vendors frequently advocate for secure development practices in their marketing materials and customer guidance.

The complexity of modern security products also contributes to the problem. These aren't simple firewalls anymore - they're sophisticated platforms with multiple integration points, complex configuration options, and extensive feature sets. This complexity increases the attack surface and makes thorough security testing more challenging.

Implications for the Future

The repeated failures of security products raise serious questions about the future of network security architecture. Some organisations are beginning to question the traditional approach of relying heavily on perimeter security products. This has led to increased interest in zero-trust architectures, where no device or service is inherently trusted, regardless of its role or vendor.

However, implementing zero trust isn't simple, and many organisations remain dependent on traditional security products. This creates a challenging situation where organisations must continue using potentially vulnerable security products while trying to minimize their exposure and build more resilient security architectures.

Call for Change

The Ivanti case isn't just another security incident - it's a wake-up call for the entire security industry. When security products become attack vectors, the fundamental premise of network security is undermined. The industry needs a fundamental shift in how security products are developed, tested, and deployed. This might include:

• Mandatory independent security audits for critical security products
• More transparent vulnerability disclosure and patching processes
• Simplified product architectures that reduce attack surfaces
• Better security testing frameworks specifically designed for security products
• Industry-wide standards for secure development practices in security products