Scattershot3

Detailed View

INFO SS3-001 — Live Host Discovered

Description: A host responded to ICMP ping or TCP probe during phase 1 host discovery. The host is alive and will be included in subsequent scan phases.

Remediation: Document all discovered hosts and verify they are authorised to be present on the network segment.

CVSS Vector: N/A

OWASP Web: N/A

INFO SS3-002 — Open Port Discovered

Description: An open TCP/UDP port was detected on a live host. The service listening on the port will be probed for version information and vulnerabilities.

Impact: Each discovered open port represents a network service accessible to attackers. Identifying all open ports is a prerequisite for targeted service exploitation and provides the baseline for vulnerability assessment.

Remediation: Review all open ports and close any that are not required for business operations.

CVSS Vector: N/A

OWASP Web: OWASP-A05:2021

MEDIUM SS3-003 — TLS 1.0 Enabled

Description: The server accepts TLS 1.0 connections. TLS 1.0 is deprecated due to known weaknesses including BEAST, POODLE, and weak cipher suites. PCI DSS 3.2+ requires disabling TLS 1.0.

Remediation: Disable TLS 1.0 on the server. Configure a minimum of TLS 1.2. Prefer TLS 1.3.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

MEDIUM SS3-004 — TLS 1.1 Enabled

Description: The server accepts TLS 1.1 connections. TLS 1.1 is deprecated and does not support modern authenticated cipher suites.

Remediation: Disable TLS 1.1. Configure minimum TLS 1.2 with strong cipher suites.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

CRITICAL SS3-005 — SSLv2 Enabled

Description: The server accepts SSLv2 connections. SSLv2 is fundamentally broken and vulnerable to the DROWN attack (CVE-2016-0800), which can decrypt TLS 1.2 sessions.

Remediation: Disable SSLv2 immediately. Configure modern TLS 1.2+ with authenticated encryption cipher suites.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

HIGH SS3-006 — SSLv3 Enabled

Description: The server accepts SSLv3 connections. SSLv3 is vulnerable to the POODLE attack (CVE-2014-3566), which allows decryption of CBC-encrypted TLS sessions.

Remediation: Disable SSLv3. Enable only TLS 1.2 and TLS 1.3.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

HIGH SS3-007 — Weak Cipher Suite Enabled

Description: The server supports cipher suites providing 64-bit or less symmetric encryption, export-grade key exchange, or null/anonymous authentication (RC4, DES, 3DES, EXPORT, aNULL, eNULL).

Remediation: Disable all weak cipher suites. Allow only AEAD ciphers (AES-GCM, ChaCha20-Poly1305) with 128-bit or greater key length.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

MEDIUM SS3-008 — Self-Signed TLS Certificate

Description: The server presents a self-signed certificate not issued by a trusted certificate authority. Clients cannot verify the server's identity, enabling MITM attacks.

Remediation: Replace the self-signed certificate with one issued by a trusted CA. For internal services, deploy an internal PKI.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

HIGH SS3-009 — Expired TLS Certificate

Description: The server's TLS certificate has passed its expiry date. Expired certificates are rejected by modern clients with a hard error, and indicate poor certificate lifecycle management.

Remediation: Renew the certificate immediately. Implement automated certificate renewal (Let's Encrypt / ACME protocol).

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: OWASP-A02:2021

CRITICAL SS3-010 — TLS Heartbleed Vulnerability

Description: The server is vulnerable to Heartbleed (CVE-2014-0160). An attacker can read up to 64 KB of server process memory per request, potentially exposing private keys, session tokens, and plaintext data.

Remediation: Upgrade OpenSSL to 1.0.1g or later. Revoke and replace server certificates and private keys. Invalidate all session tokens.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A06:2021

HIGH SS3-011 — SMB Signing Disabled

Description: SMB packet signing is not required on this host. Without signing, relay attacks (NTLM relay) allow an attacker to authenticate as any user whose credentials can be intercepted.

Remediation: Enable and require SMB signing via Group Policy: 'Microsoft network server: Digitally sign communications (always)'. Enable on all domain controllers and clients.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: SC-8, IA-3

PCI DSS 4: 4.2.1

CRITICAL SS3-012 — SMB Share Accessible (No Authentication)

Description: An SMB share is accessible without authentication (null session or guest access). Files and directories on the share are readable and potentially writable by unauthenticated users.

Remediation: Disable null session access. Remove guest accounts. Enforce authentication on all shares. Audit share permissions.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A01:2021

MEDIUM SS3-013 — SMB Share Accessible (Authenticated)

Description: An SMB share is accessible using provided credentials. The share may expose sensitive files, configuration data, or provide a foothold for lateral movement.

Remediation: Apply least-privilege access controls to all SMB shares. Audit who has read/write access. Remove unnecessary shares.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

HIGH SS3-014 — LLMNR/NBT-NS Response Captured (Responder)

Description: Responder captured an LLMNR or NBT-NS broadcast and responded with a poisoned answer. The victim host sent an NTLM authentication attempt to the attacker.

Remediation: Disable LLMNR and NBT-NS via Group Policy. Enable SMB signing. Deploy 802.1X port authentication. Monitor for LLMNR/NBT-NS traffic.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: IA-3, SC-8, CM-7

PCI DSS 4: 1.3.2, 2.2.4

CRITICAL SS3-015 — NTLMv1 Hash Captured

Description: An NTLMv1 authentication hash was captured via Responder poisoning. NTLMv1 is trivially crackable in seconds using rainbow tables or GPU brute force.

Remediation: Disable NTLMv1 via Group Policy: 'Network security: LAN Manager authentication level' to 'Send NTLMv2 response only'. Disable LLMNR and NBT-NS.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: IA-3, SC-8, CM-7

PCI DSS 4: 1.3.2, 2.2.4

HIGH SS3-016 — NTLMv2 Hash Captured

Description: An NTLMv2 authentication hash was captured via Responder poisoning. NTLMv2 hashes are crackable offline with GPU-accelerated password cracking tools.

Remediation: Disable LLMNR and NBT-NS. Enforce SMB signing. Use Kerberos authentication in AD environments. Deploy a strong password policy.

CVSS Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A07:2021

CRITICAL SS3-017 — Default Credentials Accepted

Description: A service accepted a known factory-default username and password combination. Default credentials are documented publicly and exploited trivially.

Remediation: Change default credentials immediately on all devices and services. Implement a credential management policy and enforce credential rotation.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

CRITICAL SS3-018 — SSH Brute-Force Credentials Valid

Description: Hydra discovered valid SSH credentials by brute-forcing the login service. An attacker can authenticate interactively and gain shell access to the target host.

Remediation: Implement SSH key-based authentication and disable password authentication. Deploy fail2ban or equivalent. Enforce account lockout policy.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-5, AC-7, SI-4

PCI DSS 4: 8.3.1, 8.3.4, 8.3.6

HIGH SS3-019 — FTP Anonymous Login Enabled

Description: The FTP server permits anonymous login. Any user can authenticate without credentials and browse accessible files.

Remediation: Disable anonymous FTP access. If FTP is required, enforce authenticated access. Prefer SFTP or FTPS over plaintext FTP.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

HIGH SS3-020 — Nuclei: Known CVE Vulnerability Detected

Description: Nuclei's CVE template library identified a known CVE in a service banner, web application, or network protocol response. The specific CVE and affected component are recorded in the finding evidence.

Remediation: Apply the vendor-supplied patch for the identified CVE. If no patch is available, implement compensating controls (WAF rule, network segmentation, disable the vulnerable feature).

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

HIGH SS3-021 — Nuclei: Exposed Admin Panel

Description: Nuclei detected an administrative interface (web admin panel, management console, or device configuration portal) exposed without IP restriction.

Remediation: Restrict admin panel access to authorised management networks only. Implement MFA. Place behind VPN where possible.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A05:2021

CRITICAL SS3-022 — Nuclei: Default Login Accepted

Description: Nuclei's default-login template confirmed a vendor-default credential pair is accepted by a web application or management interface.

Remediation: Change all default credentials. Enforce a password rotation policy. Add MFA to web-accessible management interfaces.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MEDIUM SS3-023 — Nuclei: Misconfiguration Detected

Description: Nuclei identified a security misconfiguration in a web application, server, or network service (e.g. debug endpoint enabled, directory listing, overly permissive CORS, missing security headers).

Remediation: Review the specific misconfiguration identified in the evidence field and apply the vendor or CIS hardening guidance.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MEDIUM SS3-024 — HTTP Security Header Missing

Description: One or more recommended HTTP security response headers are absent: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, or Permissions-Policy.

Remediation: Add the missing security headers to the web server or application configuration. Implement a strong Content Security Policy. Enable HSTS with preloading.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

LOW SS3-025 — Information Disclosure: Web Server

Description: The HTTP Server response header discloses the web server software and version (e.g. Apache/2.4.51 or nginx/1.23.0). This aids reconnaissance and CVE lookup for attackers.

Remediation: Configure the web server to suppress or obscure the Server header. On Apache: ServerTokens Prod. On nginx: server_tokens off.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

MEDIUM SS3-026 — Directory Listing Enabled

Description: The web server returns a directory listing when no index file is present. File paths, names, and modification timestamps are exposed to unauthenticated users.

Remediation: Disable directory listing on the web server. Add an index file to directories that must be accessible. Apache: Options -Indexes. nginx: autoindex off.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

CRITICAL SS3-027 — SQL Injection Vulnerability

Description: sqlmap detected a SQL injection vulnerability in a web application parameter. An attacker can extract, modify, or delete database contents, potentially gaining OS-level command execution.

Remediation: Use parameterised queries or prepared statements. Apply input validation and output encoding. Deploy a WAF with SQLi signatures. Conduct a full application security review.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A03:2021

HIGH SS3-028 — Cross-Site Scripting (XSS) Vulnerability

Description: XSStrike or ZAP detected a reflected or stored XSS vulnerability. An attacker can inject scripts into pages viewed by other users, leading to session hijacking or credential theft.

Remediation: Apply context-aware output encoding for all user-controlled data. Implement a strict Content-Security-Policy. Validate and sanitise all inputs server-side.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP Web: OWASP-A03:2021

HIGH SS3-029 — SNMP Community String Exposed

Description: The device accepts the default SNMP community string ('public' for read or 'private' for read/write). SNMP data exposes network topology, interface statistics, routing tables, and device configurations.

Remediation: Change SNMP community strings from defaults. Restrict SNMP access by source IP ACL. Migrate to SNMPv3 with authentication and encryption. Disable SNMP if not needed.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A05:2021

HIGH SS3-030 — LDAP Anonymous Bind Permitted

Description: The LDAP server permits anonymous bind. Unauthenticated clients can query directory objects including user accounts, groups, and potentially password hashes.

Remediation: Disable anonymous LDAP bind in the directory service configuration. Require authenticated binds. Restrict LDAP query access to authorised service accounts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1087.002 (Discovery)

NIST 800-53: AC-3, IA-2, CM-7

PCI DSS 4: 7.2.1, 8.2.1

INFO SS3-031 — Active Directory Domain Controller Identified

Description: A host with open ports 88 (Kerberos), 389 (LDAP), and/or 3268 (Global Catalog) was identified as a likely Active Directory domain controller.

Remediation: Ensure domain controllers are hardened per Microsoft Security Compliance Baseline. Restrict DC access to authorised management subnets.

CVSS Vector: N/A

OWASP Web: N/A

HIGH SS3-032 — Kerberoastable Service Account Identified

Description: Kerbrute or ldapdomaindump identified a service account with a ServicePrincipalName (SPN). Kerberos TGS tickets for SPNs can be requested without privilege and cracked offline.

Remediation: Use Group Managed Service Accounts (gMSA) with 120+ character auto-rotated passwords. Audit and remove unnecessary SPNs. Monitor for TGS ticket requests.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1558.003 (Credential Access)

NIST 800-53: IA-5, AC-6, AU-12

PCI DSS 4: 8.3.1, 8.4.2

HIGH SS3-033 — AS-REP Roastable Account Identified

Description: A user account has Kerberos pre-authentication disabled. An AS-REP response can be requested and cracked offline without any credentials.

Remediation: Enable Kerberos pre-authentication on all user accounts. Do not disable pre-authentication without explicit justification. Enforce strong passwords on any accounts that require it disabled.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1558.004 (Credential Access)

NIST 800-53: IA-5, AC-6

PCI DSS 4: 8.3.1

CRITICAL SS3-034 — BloodHound: Attack Path to Domain Admin Found

Description: BloodHound-Python graph collection identified a privilege escalation path from a compromised account to Domain Admin rights, typically via ACL abuse, constrained delegation, or group membership chains.

Remediation: Review and remediate the specific attack path(s) identified. Remove excessive ACL delegations. Apply the principle of least privilege to service accounts and admin groups.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1482 (Discovery), T1087.002 (Discovery), T1069.002 (Discovery)

NIST 800-53: AC-6, AC-2, AU-12

PCI DSS 4: 7.2.1, 8.4.2

HIGH SS3-035 — NFS Export Accessible Without Authentication

Description: An NFS export is accessible without authentication or with world-readable permissions. Sensitive files on the export may be readable or writable by any network host.

Remediation: Restrict NFS exports to specific client IPs in /etc/exports. Use root_squash and nosuid options. Disable NFS if not required.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

HIGH SS3-036 — RDP Exposed to Network

Description: Remote Desktop Protocol (port 3389) is accessible from the network. RDP has a history of critical vulnerabilities and exposes the authentication surface to brute-force attacks.

Remediation: Restrict RDP to management VLANs. Require MFA for all RDP sessions. Patch against BlueKeep and DejaBlue. Use NLA (Network Level Authentication). Deploy RDP gateway.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A05:2021

HIGH SS3-037 — Telnet Service Exposed

Description: Telnet (port 23) is exposed on the network. Telnet transmits all data including credentials in cleartext. Any network observer can capture usernames and passwords.

Remediation: Disable Telnet. Replace with SSH. If Telnet is required on embedded hardware, isolate on a dedicated management network.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

HIGH SS3-038 — FTP Cleartext Credentials

Description: FTP (port 21) transmits credentials in cleartext. Credentials captured during banner grab or brute-force are fully readable by any network observer.

Remediation: Replace FTP with SFTP (SSH File Transfer Protocol) or FTPS (FTP over TLS). Disable FTP where possible.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

CRITICAL SS3-039 — VNC Accessible Without Authentication

Description: A VNC service is accessible from the network without requiring authentication. An attacker has full graphical desktop access to the system.

Remediation: Enable VNC authentication immediately. Restrict VNC access to management networks. Use a VPN for remote access. Prefer alternatives with stronger authentication.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

HIGH SS3-040 — WordPress Vulnerability Detected (WPScan)

Description: WPScan identified a known vulnerability in the WordPress core, a plugin, or a theme. WordPress vulnerabilities frequently lead to RCE, data exfiltration, or credential theft.

Remediation: Update WordPress core, all plugins, and themes to the latest version. Remove unused plugins and themes. Harden WordPress per the WordPress Security Codex.

Effort: Medium

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

MEDIUM SS3-041 — Gobuster: Sensitive Path Discovered

Description: Gobuster directory brute-force discovered a sensitive path such as /admin, /backup, /.git, /config, /api/v1, or /.env exposed on the web server.

Remediation: Remove sensitive paths from web root. Restrict access to admin paths via IP allowlist. Ensure .git directories are not served publicly. Audit all discovered paths.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

CRITICAL SS3-042 — IPMI Authentication Bypass

Description: The IPMI/BMC interface is vulnerable to an authentication bypass (CVE-2013-4786 / Cipher 0 attack) allowing unauthenticated access to server management functions.

Remediation: Disable IPMI Cipher Suite 0. Update BMC firmware. Restrict IPMI access to dedicated management VLANs. Require strong authentication.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078 (Defense Evasion), T1110 (Credential Access)

NIST 800-53: IA-2, IA-3, CM-7

PCI DSS 4: 8.2.1, 2.2.4

CRITICAL SS3-043 — Oracle Database Default Credentials (ODAT)

Description: ODAT discovered valid credentials on an Oracle database listener (port 1521). An attacker with database access can exfiltrate data or escalate to OS-level command execution.

Remediation: Change Oracle default accounts (SYS, SYSTEM, DBSNMP, SCOTT). Apply Oracle CPUs. Restrict listener access by IP. Disable remote OS authentication.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

CRITICAL SS3-044 — MSSQL Default Credentials (msdat)

Description: msdat discovered valid credentials on a Microsoft SQL Server (port 1433/1434). Attackers can query data, execute xp_cmdshell, or use MSSQL as a pivot point.

Remediation: Disable the SA account or change its password. Enable SQL Server Audit. Restrict port 1433 to application servers only. Disable xp_cmdshell.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7

PCI DSS 4: 8.2.1, 8.3.1

HIGH SS3-045 — Sploitus: Public Exploit Available for Detected Version

Description: Sploitus API returned a public exploit matching the service version detected during port scanning. The vulnerability is actively exploitable with publicly available tooling.

Remediation: Patch the affected service to the latest version. Implement network-level compensating controls until patching is complete. Prioritise remediation based on exploitability.

Effort: Low

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

HIGH SS3-046 — Metasploit Module Available for Detected Vulnerability

Description: The Metasploit Framework contains one or more scanner or exploit modules matching a CVE identified during scanning. The presence of a Metasploit module significantly lowers the barrier to exploitation; unskilled attackers can use these modules without deep vulnerability knowledge. Scanner modules (auxiliary/scanner/*) provide non-destructive validation of exploitability. Exploit modules are listed for consultant reference only and are never automatically executed by Scattershot3.

Remediation: Patch the affected software to eliminate the underlying vulnerability. Review the Metasploit module documentation for exploitation conditions and implement compensating controls (network segmentation, WAF rules, IDS/IPS signatures) until patching is complete. Use the scanner module for non-destructive confirmation of exploitability.

Effort: Low

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

CRITICAL SS3-047 — EternalBlue (MS17-010) — Host Confirmed Vulnerable

Description: The target host has been positively confirmed as vulnerable to EternalBlue (MS17-010). The SMBv1 implementation in the Windows SMB server does not properly handle transaction requests, allowing an unauthenticated remote attacker to execute arbitrary code with SYSTEM privileges. This vulnerability was weaponised by the WannaCry and NotPetya ransomware families and remains one of the most widely exploited vulnerabilities in existence. Successful exploitation requires no credentials and provides complete control of the target host.

Remediation: Apply Microsoft security update MS17-010 immediately. Disable SMBv1 via PowerShell: Set-SmbServerConfiguration -EnableSMB1Protocol $false. Block port 445 at perimeter and between network segments. Verify patch status via WSUS or SCCM.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

CRITICAL SS3-048 — EternalBlue (MS17-010) — Likely Vulnerable (SMBv1 + Unpatched)

Description: The target host exposes SMBv1 and does not appear to have the MS17-010 patch applied, indicating a high likelihood of vulnerability to EternalBlue. While this finding is based on banner analysis and SMB negotiation response rather than active exploitation confirmation, the combination of SMBv1 enabled and absence of patching indicators represents a critical exposure. EternalBlue (CVE-2017-0144) allows unauthenticated remote code execution with SYSTEM privileges on unpatched Windows hosts.

Remediation: Apply MS17-010 immediately. Disable SMBv1: Set-SmbServerConfiguration -EnableSMB1Protocol $false. Validate patch status using the Metasploit auxiliary scanner (auxiliary/scanner/smb/smb_ms17_010) for definitive confirmation. Isolate host until patched.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

CRITICAL SS3-049 — SMBv1 Protocol Enabled (EternalBlue Risk)

Description: The SMBv1 protocol is enabled on this host. SMBv1 is a legacy protocol deprecated by Microsoft in 2014 that contains the vulnerability class exploited by EternalBlue (MS17-010). Even if MS17-010 is patched, SMBv1 contains additional weaknesses including susceptibility to NTLM relay attacks and other protocol-level vulnerabilities. Microsoft recommends disabling SMBv1 entirely on all systems regardless of patch level.

Remediation: Disable SMBv1 via Group Policy (Computer Configuration > Administrative Templates > Network > Lanman Workstation > Enable insecure guest logons: Disabled) or PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. Verify with: Get-SmbServerConfiguration | Select EnableSMB1Protocol.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1021.002 (Lateral Movement)

NIST 800-53: CM-7, SI-2, CM-6

PCI DSS 4: 6.3.3, 2.2.4

CRITICAL SS3-050 — IPMI 2.0 Cipher Suite 0 — Authentication Bypass and Hash Capture

Description: The IPMI 2.0 implementation on this host accepts Cipher Suite 0 (null authentication), allowing an unauthenticated attacker to authenticate to the BMC with any password (CVE-2013-4786). Additionally, the IPMI 2.0 RAKP protocol leaks a salted SHA1 or MD5 hash of the remote management password during the authentication handshake, enabling offline password cracking even when Cipher Suite 0 is disabled. Successful exploitation grants full out-of-band server management access including console, power control, and firmware update capabilities.

Remediation: Disable IPMI Cipher Suite 0 in BMC configuration. Update BMC firmware to the latest version from the vendor. Restrict IPMI access (UDP 623) to dedicated out-of-band management VLANs with strict ACLs. Change all IPMI passwords to long, randomly generated values.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078 (Defense Evasion), T1110 (Credential Access)

NIST 800-53: IA-2, IA-3, CM-7

PCI DSS 4: 8.2.1, 2.2.4

HIGH SS3-051 — SSH Vulnerability: SSHv1 Protocol Supported

Description: The SSH server on this host advertises support for the SSHv1 protocol. SSHv1 is cryptographically broken and contains fundamental design flaws including the ability to insert arbitrary data into SSH sessions and an information disclosure vulnerability in RSA key exchange. SSHv1 has been deprecated since 2006 and its use undermines the integrity and confidentiality guarantees of the SSH channel.

Remediation: Disable SSHv1 in the sshd configuration: set 'Protocol 2' in /etc/ssh/sshd_config. Restart the SSH service. Verify with: ssh -1 <host> to confirm SSHv1 is rejected.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, CM-7, CM-6

PCI DSS 4: 4.2.1, 2.2.4

CRITICAL SS3-052 — SSH Vulnerability: 'none' Authentication Accepted (libSSH Bypass CVE-2018-10933)

Description: The SSH server accepts the 'none' authentication method due to an authentication bypass vulnerability in libSSH (CVE-2018-10933). An attacker can send an SSH2_MSG_USERAUTH_SUCCESS message before authentication is complete, causing the server to grant full authenticated access without any valid credentials. This affects libSSH versions 0.6.0 through 0.7.5 and 0.8.0 through 0.8.3 and provides complete unauthenticated shell access to any account.

Remediation: Upgrade libSSH to version 0.7.6 or 0.8.4 or later. For systems using OpenSSH this vulnerability does not apply — verify the SSH daemon in use. Apply vendor-supplied security patches immediately.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, CM-7, SI-2

PCI DSS 4: 6.3.3, 8.2.1

MEDIUM SS3-053 — SSH Vulnerability: Weak/Deprecated Cryptographic Algorithms

Description: The SSH server advertises support for deprecated or weak cryptographic algorithms in its key exchange, host key, cipher, or MAC algorithm list. This includes algorithms such as arcfour (RC4), 3des-cbc, blowfish-cbc, diffie-hellman-group1-sha1, hmac-md5, and hmac-sha1-96. Use of these algorithms exposes SSH sessions to potential cryptographic attacks and violates current NIST and vendor security guidance.

Remediation: Update the SSH server configuration to restrict offered algorithms. In /etc/ssh/sshd_config set: Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com; MACs hmac-sha2-256,hmac-sha2-512,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com; KexAlgorithms curve25519-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

HIGH SS3-054 — MS12-020 RDP Vulnerability Detected

Description: The Remote Desktop Protocol (RDP) service on this host appears vulnerable to MS12-020, which includes CVE-2012-0152 (denial of service via specially crafted RDP packet sequence) and CVE-2012-0002 (pre-authentication remote code execution via malformed RDP packet). CVE-2012-0002 is a pre-authentication memory corruption vulnerability affecting the Remote Desktop Protocol in Windows XP through Server 2008 R2. Exploitation can cause a crash (BSOD) or potentially allow arbitrary code execution.

Remediation: Apply Microsoft security bulletin MS12-020. Enable Network Level Authentication (NLA) as a compensating control. Restrict RDP access to authorised management networks. Block port 3389 at the perimeter firewall.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: IA-2, CM-7, AC-17

PCI DSS 4: 8.2.1, 2.2.4

HIGH SS3-055 — RDP Weak or No Encryption Configured

Description: The RDP service is configured with a low or incompatible security layer, or does not enforce strong encryption. Configurations using 'RDP Security Layer' (as opposed to 'TLS' or 'Negotiate with TLS') use RC4 encryption that is cryptographically weak and susceptible to session interception. This allows a network-positioned attacker to decrypt RDP session traffic and recover credentials or session data.

Remediation: Configure RDP to require TLS: set 'Security Layer' to 'SSL (TLS 1.0)' or higher in Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options). Enforce NLA. Apply a valid certificate to the RDP service.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: IA-2, CM-7, AC-17

PCI DSS 4: 8.2.1, 2.2.4

HIGH SS3-056 — RDP Without NLA (Network Level Authentication) — BlueKeep Exposure

Description: Network Level Authentication (NLA) is not enforced on the RDP service. Without NLA, unauthenticated network sessions are established before user credentials are validated, exposing the pre-authentication attack surface to vulnerabilities such as BlueKeep (CVE-2019-0708) and DejaBlue (CVE-2019-1182). NLA moves authentication to the network transport layer, requiring credentials before a full RDP session is established.

Remediation: Enable NLA via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security > Require user authentication for remote connections by using NLA. Set to Enabled.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1021.001 (Lateral Movement)

NIST 800-53: IA-2, CM-7, AC-17

PCI DSS 4: 8.2.1, 2.2.4

HIGH SS3-057 — NFS Export Points Enumerated — Potentially Unauthenticated Access

Description: The NFS server responded to a showmount query and disclosed its export list. One or more exports are configured with overly permissive client specifications (e.g., wildcard '*', broad CIDR ranges, or no_root_squash), potentially allowing unauthenticated or minimally privileged network hosts to mount and access file system contents. Exposed NFS exports frequently contain sensitive data including SSH keys, configuration files, and application data.

Remediation: Audit /etc/exports and restrict each export to specific IP addresses or minimal CIDR ranges. Apply root_squash to all exports. Remove exports that are not required. Restrict showmount queries by blocking RPC portmapper (port 111) and NFS (port 2049) at the network boundary.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1083 (Discovery), T1005 (Collection)

NIST 800-53: AC-3, AC-6, CM-7

PCI DSS 4: 1.3.1, 7.2.1

MEDIUM SS3-058 — NFS Directory Listing Accessible

Description: An NFS-mounted export directory listing was successfully retrieved, confirming that the export can be mounted and browsed from the scanning host. The directory contents, file names, permissions, and modification timestamps are visible. This confirms NFS access is possible and that the export is not adequately restricted by client IP, user authentication, or Kerberos-based NFS (krb5 security flavour).

Remediation: Restrict NFS exports to specific authorised client IP addresses. Enable Kerberos authentication for NFS (sec=krb5p). Apply appropriate file permissions within the export. Consider migrating to SFTP or object storage for external file sharing.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1083 (Discovery), T1005 (Collection)

NIST 800-53: AC-3, AC-6, CM-7

PCI DSS 4: 1.3.1, 7.2.1

HIGH SS3-059 — SMTP Open Mail Relay Detected

Description: The SMTP server on this host will relay email for external domains, acting as an open mail relay. Open relays can be abused by spammers and phishing actors to send bulk email that appears to originate from the target organisation's IP space, damaging the organisation's email reputation, causing blacklisting, and potentially facilitating phishing campaigns. Open relays are identified by sending a test message from an external address to an external recipient via the server.

Remediation: Configure the SMTP server to reject relay for domains it is not authoritative for. On Postfix: set mynetworks to trusted IP ranges only, configure smtpd_recipient_restrictions to reject_unauth_destination. On Sendmail: configure access DB to deny relaying. Implement SPF, DKIM, and DMARC.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1078 (Defense Evasion), T1566 (Initial Access)

NIST 800-53: CM-7, SC-5, SI-8

PCI DSS 4: 1.3.1, 5.4.1

MEDIUM SS3-060 — SMTP User Enumeration Possible via VRFY

Description: The SMTP server responds to VRFY (verify) commands, allowing an unauthenticated client to enumerate valid email addresses and usernames on the system. The VRFY command returns a 250 OK response for valid addresses and a 550 response for invalid ones. This provides an attacker with a list of valid accounts for targeted brute-force, phishing, or credential stuffing attacks.

Remediation: Disable the SMTP VRFY command. On Postfix: set disable_vrfy_command = yes in main.cf. On Exchange: VRFY is disabled by default but verify. Implement rate limiting and connection throttling on SMTP ports.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 2.2.4

MEDIUM SS3-061 — SIP Extension / User Enumeration

Description: The SIP (Session Initiation Protocol) service responds differently to OPTIONS or REGISTER requests for valid versus invalid extensions, enabling enumeration of valid user accounts and extensions. SVMap or a similar SIP scanner identified valid SIP usernames by observing differential server responses (200 OK vs 403 Forbidden vs 404 Not Found). Enumerated extensions can be targeted for brute-force authentication attacks to gain free VoIP calling or eavesdropping capabilities.

Remediation: Configure the SIP server (Asterisk, FreePBX, Cisco UCM) to return uniform error responses regardless of extension validity. Implement SIP authentication on all extensions. Apply rate limiting and IP blocking for repeated failed registrations. Restrict SIP access to known client networks.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: CM-7, SC-7

PCI DSS 4: 2.2.4

MEDIUM SS3-062 — WebDAV Enabled

Description: The web server has WebDAV (Web-based Distributed Authoring and Versioning) enabled. WebDAV extends HTTP with methods including PROPFIND, MKCOL, COPY, MOVE, LOCK, and DELETE. If write access is granted to unauthenticated or low-privileged users, an attacker can upload arbitrary files including web shells, leading to remote code execution. Even read-only WebDAV can disclose file system metadata and source code.

Remediation: Disable WebDAV if not required. If WebDAV is necessary, restrict it to authenticated users over HTTPS, limit access by IP, and audit PROPFIND and PUT/MKCOL method access in web server logs. On IIS: remove the WebDAV Publishing role feature. On Apache: remove the mod_dav and mod_dav_fs modules.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 2.2.4, 6.2.4

MEDIUM SS3-063 — JetDirect / PJL Printer Accessible

Description: An HP JetDirect or compatible printer management interface (port 9100 / PJL) is accessible from the network. The Printer Job Language (PJL) protocol allows reading and writing the printer file system, retrieving print job history, changing configuration settings, and in some models extracting stored credentials. Unauthenticated access to PJL is a well-known attack vector against printers exposed on corporate networks.

Remediation: Restrict access to port 9100 (JetDirect/RAW printing) using firewall ACLs to authorised print servers only. Disable PJL filesystem access commands in the printer administration console. Enable printer authentication and update firmware. Segment printers on a dedicated VLAN.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7, AC-3

PCI DSS 4: 1.3.1, 2.2.4

CRITICAL SS3-064 — Redis Unauthenticated Access

Description: The Redis server on this host is accessible without authentication. Redis provides no access control beyond an optional password, and when exposed without authentication, allows any connected client to read, overwrite, or delete the entire key-value store. Redis supports commands such as CONFIG SET that can be abused to write attacker-controlled files to arbitrary locations on the server filesystem, commonly used to achieve remote code execution via cron job or SSH authorized_keys injection.

Remediation: Enable Redis authentication (requirepass) with a long randomly generated password. Bind Redis to localhost (bind 127.0.0.1) unless remote access is explicitly required. Use Redis 6+ ACL system to enforce per-user permissions. Block port 6379 at the network perimeter. Deploy Redis behind a VPN or bastion host.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, AC-6, CM-6

PCI DSS 4: 6.2.4, 2.2.1

CRITICAL SS3-065 — MySQL Unauthenticated Access — Root with No Password

Description: The MySQL server accepts connections as the root user without a password from the network. This grants an attacker full database administrator access including the ability to read, write, and delete any database, load/dump files to and from the server filesystem using LOAD DATA INFILE and SELECT INTO OUTFILE, and potentially execute OS commands via User-Defined Functions (UDFs). This represents complete compromise of database confidentiality and integrity.

Remediation: Assign a strong password to the MySQL root account: ALTER USER 'root'@'%' IDENTIFIED BY 'strong_password'; Revoke remote root access: DELETE FROM mysql.user WHERE User='root' AND Host!='localhost'; Bind MySQL to localhost or a specific management interface. Restrict remote access with GRANT statements limited to specific source IPs.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7

PCI DSS 4: 8.2.1, 8.3.1

HIGH SS3-066 — MySQL CVE-2012-2122 Authentication Bypass Risk

Description: The MySQL version detected on this host is potentially vulnerable to CVE-2012-2122, a memory comparison timing flaw in the authentication protocol. Due to a memcmp() optimisation in certain Linux builds and MySQL versions (5.1.x before 5.1.63, 5.5.x before 5.5.24, 5.6.x before 5.6.6), an attacker who sends the correct password approximately once in every 256 login attempts will bypass authentication. With repeated automated attempts, this allows authentication bypass for any known username including root.

Remediation: Upgrade MySQL to a patched version (5.1.63+, 5.5.24+, 5.6.6+). Apply the vendor security patch. As a compensating control, restrict MySQL access by IP using GRANT statements and firewall rules.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, SI-2

PCI DSS 4: 6.3.3, 8.2.1

CRITICAL SS3-067 — VMware ESXi Management Interface Exposed

Description: A VMware ESXi management interface (vSphere Client HTTPS on port 443, or ESXi Shell on port 22) is accessible from the network. ESXi hypervisors represent a critical attack surface: compromise of the hypervisor provides control over all guest virtual machines including the ability to power off, snapshot, clone, or extract disk images. ESXi has been a frequent ransomware target (ESXiArgs, Royal, BlackBasta), and exposed management interfaces are frequently exploited using known CVEs such as CVE-2021-22005 and CVE-2022-47966.

Remediation: Restrict ESXi management access (ports 443, 22, 902, 5900) to dedicated management VLANs and bastion hosts. Disable ESXi Shell and SSH when not in use. Apply VMware security advisories and vSphere patches immediately. Enable two-factor authentication via vCenter. Join hosts to vCenter and manage via RBAC rather than direct host access.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1210 (Lateral Movement), T1046 (Discovery)

NIST 800-53: CM-7, AC-17, RA-5

PCI DSS 4: 1.3.1, 6.3.3

CISA KEV

HIGH SS3-068 — RPC Null Session Permitted

Description: The Windows RPC endpoint mapper accepts unauthenticated null session connections. A null session permits unauthenticated enumeration of shares, users, groups, and registry information via MS-RPC interfaces. This is frequently combined with SMB null session enumeration and forms a key component of unauthenticated Windows host reconnaissance, providing the attacker with Active Directory user account lists, group memberships, and domain SID information.

Remediation: Restrict anonymous RPC access via Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options: 'Network access: Restrict anonymous access to Named Pipes and Shares' = Enabled. Set 'Network access: Do not allow anonymous enumeration of SAM accounts' = Enabled.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1135 (Discovery), T1078 (Defense Evasion)

NIST 800-53: AC-3, CM-7, IA-2

PCI DSS 4: 7.2.1, 2.2.4

HIGH SS3-069 — SMB Null Session Permitted

Description: The SMB server permits null session connections — unauthenticated connections using an empty username and password. Via a null session, an attacker can enumerate share names, user accounts, group memberships, local policies, and domain SID information using tools such as enum4linux, rpcclient, or CrackMapExec. This information provides the reconnaissance foundation for subsequent targeted attacks including password spraying, credential brute-force, and Kerberoasting.

Remediation: Enable the following Group Policy settings: 'Network access: Do not allow anonymous enumeration of SAM accounts' = Enabled; 'Network access: Do not allow anonymous enumeration of SAM accounts and shares' = Enabled; 'Network access: Restrict anonymous access to Named Pipes and Shares' = Enabled.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1135 (Discovery), T1078 (Defense Evasion)

NIST 800-53: AC-3, CM-7, IA-2

PCI DSS 4: 7.2.1, 2.2.4

CRITICAL SS3-070 — SMB Administrative Access via Credentials

Description: Valid credentials were used to authenticate to the SMB service with administrative privileges, and access to administrative shares (C$, ADMIN$, IPC$) was confirmed. Administrative SMB access allows reading and writing files anywhere on the target filesystem, remote service/registry manipulation, and is the primary mechanism used by post-exploitation frameworks (Impacket, CrackMapExec, Metasploit) for lateral movement and remote code execution via PsExec, WMIExec, or SMBExec.

Remediation: Rotate compromised credentials immediately. Implement LAPS (Local Administrator Password Solution) to randomise local administrator passwords per host. Disable the built-in administrator account. Enable SMB signing. Implement network segmentation to limit lateral movement pathways.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1069.002 (Discovery), T1021.002 (Lateral Movement)

NIST 800-53: AC-6, AC-2, IA-5

PCI DSS 4: 7.2.1, 8.4.2

HIGH SS3-071 — SMB Share Identified with WRITE Permissions

Description: An SMB share has been confirmed to be writable with the credentials used during the scan. Write access to a network share enables an attacker to plant malicious files, overwrite configuration data, introduce DLL hijacking payloads, or stage persistence mechanisms. If the share contains executable content served to other hosts, write access may lead to lateral movement or supply chain compromise within the organisation.

Remediation: Audit all SMB share permissions and apply least-privilege access controls. Remove write access from any accounts that do not require it for business purposes. Implement monitoring and alerting on new file creation events in sensitive shares. Enable SMB signing to prevent NTLM relay to share authentication.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A01:2021

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1069.002 (Discovery), T1021.002 (Lateral Movement)

NIST 800-53: AC-6, AC-2, IA-5

PCI DSS 4: 7.2.1, 8.4.2

HIGH SS3-072 — SMB Share-Level Authentication (No User-Level Auth)

Description: The SMB server is configured to use share-level authentication rather than user-level authentication. Under share-level authentication, access is controlled by a per-share password rather than user identity. This model lacks auditability (no per-user access logging), prevents granular access control, and is incompatible with modern SMB security features including SMB signing and SMBv2/3 message integrity. Share-level authentication is a legacy mechanism associated with Windows 9x/ME workgroups.

Remediation: Migrate to user-level SMB authentication. Configure the Windows workstation or server to use user-level access control: Computer > Properties > Sharing settings. Join the host to a domain and manage share access via domain user accounts and groups.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1135 (Discovery), T1078 (Defense Evasion)

NIST 800-53: AC-3, CM-7, IA-2

PCI DSS 4: 7.2.1, 2.2.4

HIGH SS3-073 — BloodHound AD Graph Data Collected

Description: BloodHound-Python successfully collected Active Directory object data including users, groups, computers, GPOs, OUs, and ACLs and produced graph database ingest files. This data enables graph-based analysis of Active Directory attack paths, privilege escalation routes, and delegation abuses. The collection itself demonstrates that the network is reachable from the attacker's position with sufficient credential access to query LDAP at the level required for BloodHound enumeration.

Remediation: Review the collected BloodHound data to identify and remediate high-risk attack paths (paths to Domain Admin, DCSync rights, unconstrained delegation). Implement tiered administration to limit exposure. Monitor LDAP query volume for anomalous bulk enumeration indicative of BloodHound collection.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1482 (Discovery), T1087.002 (Discovery), T1069.002 (Discovery)

NIST 800-53: AC-6, AC-2, AU-12

PCI DSS 4: 7.2.1, 8.4.2

HIGH SS3-074 — LDAP Domain Users Enumerated

Description: LDAP enumeration successfully retrieved a list of domain user accounts from Active Directory. The enumerated data may include usernames, display names, email addresses, account status, last logon timestamps, and group memberships. This user list provides an attacker with a validated target list for password spraying, credential stuffing, phishing, and Kerberoasting attacks. Successful LDAP enumeration often requires only a low-privileged domain account.

Remediation: Implement LDAP query monitoring and alerting for bulk user enumeration. Apply Protected Users security group membership to privileged accounts. Enforce Kerberos-only authentication for sensitive accounts. Implement fine-grained password policies. Monitor for anomalous LDAP query patterns in Windows event logs (Event ID 4661).

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1087.002 (Discovery)

NIST 800-53: AC-3, IA-2, CM-7

PCI DSS 4: 7.2.1, 8.2.1

MEDIUM SS3-075 — Valid Kerberos Usernames Enumerated

Description: Kerbrute or a similar tool enumerated valid Active Directory usernames by sending AS-REQ messages and observing Kerberos error code differences: valid accounts return KRB5KDC_ERR_PREAUTH_REQUIRED (18) or KDC_ERR_CLIENT_REVOKED (12/18) while invalid accounts return KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN (6). This technique does not require any credentials and works even when null sessions are disabled, providing a validated username list for subsequent password spray or brute-force attacks.

Remediation: Enable Kerberos pre-authentication on all accounts to reduce the information disclosed in error responses. Monitor domain controller logs for unusual AS-REQ volume (Event IDs 4768, 4771). Deploy a SIEM alert for repeated KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN errors from a single source IP.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1087.002 (Discovery)

NIST 800-53: AC-3, IA-2, CM-7

PCI DSS 4: 7.2.1, 8.2.1

HIGH SS3-076 — Domain Accounts with Password Not Required

Description: One or more Active Directory user accounts have the PASSWD_NOTREQD (UF_PASSWD_NOTREQD, userAccountControl bit 0x0020) flag set, meaning the account may have an empty or blank password. Accounts with this flag are not subject to the domain password policy minimum length requirement and can be authenticated with an empty password. These accounts represent a trivially exploitable authentication bypass if empty passwords are present.

Remediation: Identify all accounts with the PASSWD_NOTREQD flag set: Get-ADUser -Filter {PasswordNotRequired -eq $True}. Set a strong password on each account and remove the flag: Set-ADUser -Identity <user> -PasswordNotRequired $false. Audit and enforce the domain password policy.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

MITRE ATT&CK: T1078.002 (Defense Evasion)

NIST 800-53: IA-5, AC-2

PCI DSS 4: 8.3.1, 8.3.6

HIGH SS3-077 — Privileged Domain Accounts Identified

Description: LDAP enumeration identified user accounts with membership in highly privileged Active Directory groups such as Domain Admins, Enterprise Admins, Schema Admins, Backup Operators, or Account Operators. These accounts represent high-value targets for credential theft, Kerberoasting, and AS-REP roasting. Compromise of any of these accounts typically results in complete domain compromise. The identification of these accounts guides further attack path analysis.

Remediation: Apply the principle of least privilege: ensure privileged accounts are used only for administrative tasks. Enforce tiered administration (Tier 0/1/2 model). Add privileged accounts to the Protected Users security group. Enforce MFA for all administrative accounts. Restrict privileged account logon rights via GPO.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

OWASP API: API1:2023 – Broken Object Level Authorization

MITRE ATT&CK: T1069.002 (Discovery), T1021.002 (Lateral Movement)

NIST 800-53: AC-6, AC-2, IA-5

PCI DSS 4: 7.2.1, 8.4.2

HIGH SS3-078 — WordPress Core Vulnerability

Description: WPScan identified a known vulnerability in the WordPress core installation. WordPress core vulnerabilities range from authenticated RCE and privilege escalation to unauthenticated information disclosure and SSRF. The specific CVE, affected version, and exploitation details are recorded in the finding evidence. WordPress core vulnerabilities are frequently weaponised within hours of disclosure due to the large attack surface and widespread deployment.

Remediation: Update WordPress core to the latest stable version via the WordPress admin dashboard (Dashboard > Updates) or WP-CLI (wp core update). Enable automatic core updates for minor versions. Review all active plugins and themes for compatibility before updating.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

HIGH SS3-079 — WordPress Plugin Vulnerability

Description: WPScan identified a known security vulnerability in an installed WordPress plugin. Plugin vulnerabilities are the most common attack vector for WordPress sites, frequently including unauthenticated SQL injection, file upload bypass, XSS, CSRF, and remote code execution. The specific plugin name, version, CVE, and exploitation conditions are recorded in the finding evidence. Vulnerable plugins may be actively exploited using publicly available proof-of-concept code.

Remediation: Update the vulnerable plugin to the latest patched version via the WordPress admin panel (Plugins > Available Updates). If no patched version is available, deactivate and delete the plugin immediately. Consider a web application firewall (WAF) virtual patching rule as a temporary compensating control.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

HIGH SS3-080 — WordPress Theme Vulnerability

Description: WPScan identified a known security vulnerability in an active or inactive WordPress theme. Vulnerable themes can expose the site to file inclusion vulnerabilities, path traversal, XSS, and in some cases remote code execution. Inactive themes are often overlooked during patching cycles and remain exploitable as long as they are installed. The specific theme name, version, CVE, and exploitation details are recorded in the finding evidence.

Remediation: Update the vulnerable theme to the latest patched version or delete it if it is not in use. Review installed themes: Appearance > Themes. Inactive themes should be removed unless required. Prefer themes from the WordPress.org theme directory which are subject to security review.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

MEDIUM SS3-081 — WordPress User Enumeration

Description: WPScan successfully enumerated WordPress user accounts via the author archive URL pattern (?author=N) or the REST API endpoint (/wp-json/wp/v2/users). Enumerated usernames can be used directly for targeted brute-force attacks against the WordPress login page or XML-RPC endpoint. WordPress usernames are frequently identical to the account login names, making this information directly actionable for credential attacks.

Remediation: Disable author archive pages or redirect them to prevent user enumeration (add rewrite rules in .htaccess or use a security plugin). Restrict REST API access to authenticated users for the /wp-json/wp/v2/users endpoint. Use login protection plugins to rate-limit brute-force attempts. Disable XML-RPC if not required.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, CM-7, RA-5

PCI DSS 4: 6.3.3, 6.3.2

INFO SS3-082 — Discovery: Login Page

Description: A web application login page was detected on the target host. Login pages represent the primary authentication attack surface for credential brute-force, password spray, and credential stuffing attacks. The presence of a login page is recorded for documentation and to guide subsequent authentication testing phases.

Remediation: Ensure the login page is protected by account lockout or rate limiting. Implement MFA. Monitor for credential stuffing patterns in authentication logs. Restrict login page access to authorised networks where feasible.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

MITRE ATT&CK: T1078 (Initial Access), T1589 (Reconnaissance)

NIST 800-53: IA-2, AC-2

PCI DSS 4: 8.2.1

INFO SS3-083 — Discovery: Web Page

Description: A web page or HTTP service was identified on a non-standard port or host during service enumeration. The URL, title, status code, and response headers are recorded in the finding evidence for subsequent web application testing phases. This finding documents the presence of a web-accessible service for the engagement scope.

Impact: Identified web pages confirm active web content and reveal application structure, response patterns, and technology indicators. This information guides targeted testing of discovered endpoints and functionality.

Remediation: Review all web services exposed on the host and verify they are authorised and required. Remove or restrict access to any web interfaces that are not required for business operations.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

LOW SS3-084 — Default Webpage Detected

Description: The web server is serving a vendor or platform default welcome page (e.g., 'Apache2 Default Page', 'IIS Windows Server', 'nginx Default Page', 'It works!'). A default page indicates the web server was installed but not fully configured, and may indicate that additional default configurations, credentials, or directories are present. It also discloses the server platform and version to potential attackers.

Remediation: Remove the default web content and replace with application-specific content or a redirect. Disable or remove the default site configuration. Ensure server version information is suppressed in HTTP headers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A05:2021

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO SS3-085 — Application Identified at Login Page

Description: The web application framework, CMS, or product was identified from the login page content, headers, cookies, or source code. The identified application is recorded for CVE research, default credential testing, and targeted plugin/component enumeration. Application fingerprinting provides the basis for targeted vulnerability research.

Remediation: Suppress application version information in HTTP headers and page source. Remove application-identifying comments and metadata from public-facing pages. This is a reconnaissance finding; remediate the underlying application vulnerabilities identified in subsequent scans.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO SS3-086 — Authentication Method Identified

Description: The authentication mechanism used by the target web application or service was identified. This includes HTTP Basic, NTLM, Digest, Form-based, OAuth, SAML, or certificate-based authentication. The identified authentication method guides subsequent brute-force, session management, and authentication bypass testing, and is recorded for documentation.

Remediation: Ensure the identified authentication method is appropriate for the sensitivity of the resource. HTTP Basic authentication over HTTP (unencrypted) should be replaced with form-based authentication over HTTPS. Legacy NTLM authentication should be replaced with Kerberos or modern token-based authentication.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

MITRE ATT&CK: T1590 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

CRITICAL SS3-087 — Valid Credentials via Brute Force

Description: Automated credential brute-force or password spraying discovered a valid username and password combination against a network service or web application. The valid credentials have been confirmed by a successful authentication response from the target. This finding represents direct confirmation that an attacker can authenticate to the service and perform all actions permitted to the compromised account.

Remediation: Rotate the compromised credentials immediately. Implement account lockout or rate limiting on the affected service. Deploy multi-factor authentication. Review authentication logs to determine if the credentials were used by an unauthorised party prior to discovery. Enforce a strong password policy.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A07:2021

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-5, AC-7, SI-4

PCI DSS 4: 8.3.1, 8.3.4, 8.3.6

HIGH SS3-088 — Public Exploit Available

Description: A public proof-of-concept or weaponised exploit was found for a vulnerability identified during the scan, sourced from ExploitDB, GitHub, or a vulnerability intelligence feed. The availability of a public exploit significantly lowers the skill barrier for exploitation and increases the likelihood of opportunistic attacks. The associated CVE, exploit source, and affected component are recorded in the finding evidence.

Remediation: Treat the associated vulnerability as high priority for immediate patching. Apply vendor patches or mitigations. Implement compensating controls (WAF virtual patching, network segmentation, IDS/IPS signatures) until patches are applied. Monitor threat intelligence feeds for active exploitation indicators.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

HIGH SS3-089 — Metasploit Module Available

Description: A Metasploit Framework module (auxiliary scanner or exploit) was identified that matches a vulnerability or service version detected during scanning. The specific Metasploit module path is recorded in the finding evidence. The availability of a Metasploit module indicates reliable, automated exploitability and lowers the barrier to exploitation for unskilled attackers. This finding is recorded for consultant reference; Scattershot3 does not automatically execute exploit modules.

Remediation: Apply vendor patches for the underlying vulnerability. Review the Metasploit module documentation for detailed exploitation conditions and implement appropriate compensating controls (network segmentation, WAF rules, IDS signatures) until patching is complete.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1203 (Execution)

NIST 800-53: SI-2, RA-5, RA-3

PCI DSS 4: 6.3.3

MEDIUM SS3-090 — Insecure Protocol Detected: HTTP

Description: A web application or service is served over unencrypted HTTP. All data transmitted between the client and server including session cookies, form data, and credentials is transmitted in plaintext and can be intercepted by any network-positioned observer. Without HTTPS, the service is also susceptible to SSL stripping and man-in-the-middle content injection attacks.

Impact: HTTP services transmit all data in plaintext, allowing any attacker with network access to passively intercept credentials, session tokens, API keys, and business data. Active MITM attackers can also inject malicious content, redirect authentication flows, and modify transactions in transit.

Remediation: Migrate the service to HTTPS with a valid TLS certificate. Configure HTTP to HTTPS redirection. Set the Strict-Transport-Security (HSTS) header with a long max-age value. Obtain a certificate from Let's Encrypt (free) or a commercial CA.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-7

PCI DSS 4: 4.2.1, 4.2.2

HIGH SS3-091 — Deprecated Protocol Enabled

Description: A deprecated network protocol is enabled on this host. Deprecated protocols lack modern security controls including strong authentication and encryption, have known cryptographic weaknesses or design flaws, and are no longer maintained by their developers. Examples include Telnet, RSH, RLOGIN, SNMPv1/v2, RIPv1, and older versions of SMB. The specific protocol is recorded in the finding evidence.

Remediation: Disable the deprecated protocol and replace with a modern, secure alternative. Telnet: use SSH. SNMPv1/v2: use SNMPv3 with authentication and encryption. RIPv1: use RIPv2 or OSPF. Review all network service configurations for use of deprecated protocols.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-7

PCI DSS 4: 4.2.1, 4.2.2

CRITICAL SS3-092 — Information Disclosure: Plaintext Credentials in Web Content

Description: Credentials (usernames, passwords, API keys, tokens, or connection strings) were discovered in plaintext within web-accessible content, including HTML source, JavaScript files, configuration files served by the web server, or directory listing contents. Plaintext credentials in web-accessible content can be harvested by any user who can access the page and frequently provide direct access to backend databases, APIs, or privileged service accounts.

Remediation: Immediately rotate all exposed credentials. Remove credentials from web-accessible content. Use environment variables or a secrets manager (Vault, AWS Secrets Manager) for credential storage. Audit the web server document root for sensitive files. Implement web application firewall rules to prevent configuration file access.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-7

PCI DSS 4: 4.2.1, 4.2.2

MEDIUM SS3-093 — SSL/TLS Vulnerability: BEAST

Description: The server is susceptible to the BEAST attack (Browser Exploit Against SSL/TLS, CVE-2011-3389). BEAST exploits a CBC mode initialisation vector (IV) predictability vulnerability in TLS 1.0 and earlier, allowing a man-in-the-middle attacker who can inject chosen plaintext to decrypt CBC-encrypted session data. While the attack requires a network-adjacent attacker and active JavaScript injection in the victim's browser, TLS 1.0 should not be used in modern deployments.

Impact: BEAST (Browser Exploit Against SSL/TLS) exploits a vulnerability in TLS 1.0's CBC-mode cipher initialization to decrypt HTTPS cookies and authentication tokens. An attacker with network access can inject chosen plaintext to recover session secrets, enabling session hijacking.

Remediation: Disable TLS 1.0 and SSLv3 entirely. Enable TLS 1.2 and TLS 1.3. Prioritise AEAD cipher suites (AES-GCM, ChaCha20-Poly1305) which are not susceptible to BEAST. Modern TLS 1.2 with RC4 elimination and GCM prioritisation eliminates the BEAST attack surface.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

MEDIUM SS3-094 — SSL/TLS Vulnerability: LUCKY13

Description: The server supports CBC mode cipher suites with HMAC-SHA1 or HMAC-MD5, making it potentially susceptible to the LUCKY13 timing attack (CVE-2013-0169). LUCKY13 is a padding oracle attack against CBC-mode TLS that allows an attacker with precise network timing measurements to decrypt recorded TLS session data. The attack requires approximately 2^23 oracle queries per 16 bytes of plaintext decrypted and is primarily a theoretical concern but indicates use of non-AEAD cipher suites.

Impact: LUCKY13 (CVE-2013-0169) is a timing side-channel attack against CBC-mode cipher suites in TLS. An attacker with network-level access can recover plaintext from encrypted sessions by measuring processing time differences.

Remediation: Prioritise and restrict TLS cipher suites to AEAD algorithms (AES-GCM, ChaCha20-Poly1305) which are immune to CBC padding oracle attacks. Disable all CBC mode cipher suites. Enable TLS 1.3 which exclusively uses AEAD ciphers.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1557 (Collection)

NIST 800-53: SC-8, SC-28, IA-5

PCI DSS 4: 4.2.1

MEDIUM SS3-095 — SSL/TLS Vulnerability: SWEET32

Description: The server supports cipher suites using 64-bit block ciphers (Triple-DES/3DES or Blowfish), making it susceptible to the SWEET32 birthday attack (CVE-2016-2183). After approximately 2^32 blocks (about 32 GB of traffic), an attacker capturing a long-lived TLS session can exploit birthday bound collisions in the CBC mode to recover short, repeated plaintext segments such as HTTP cookies. 3DES-based cipher suites (TLS_RSA_WITH_3DES_EDE_CBC_SHA) should be considered deprecated.

Impact: SWEET32 exploits the birthday bound weakness in 64-bit block ciphers (3DES, Blowfish) used in TLS. After capturing approximately 32GB of ciphertext from a long-lived session, an attacker can recover plaintext blocks, potentially exposing session cookies and authentication tokens.

Remediation: Disable all 64-bit block cipher suites including 3DES (TRIPLE-DES, 3DES-EDE-CBC-SHA) and Blowfish. Ensure the server's cipher list does not include any cipher containing DES or 3DES. Enable only AES-128 and AES-256 based ciphers with GCM mode.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

NIST 800-53: SC-8, SC-28

PCI DSS 4: 4.2.1

MEDIUM SS3-096 — SSL/TLS Certificate: Chain Incomplete

Description: The TLS server does not present the full certificate chain during the TLS handshake, omitting one or more intermediate CA certificates. Clients that do not have the intermediate certificate pre-cached will be unable to build a trusted chain to the root CA and will display a certificate error. This indicates a misconfiguration in the server's TLS certificate installation. Some strict clients and mobile browsers do not perform intermediate certificate fetching (AIA chasing) and will fail validation.

Impact: An incomplete certificate chain prevents clients from validating the certificate's trust path. Some clients may reject the connection outright, while others silently proceed without full validation, creating inconsistent security posture across the user base.

Remediation: Reconfigure the TLS server to present the full certificate chain including all required intermediate CA certificates. Obtain the intermediate certificates from the issuing CA and concatenate them with the server certificate in the correct order (leaf first, then intermediates). Verify with: openssl s_client -connect <host>:443 -showcerts.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

LOW SS3-097 — SSL/TLS Certificate: Long Duration

Description: The TLS certificate has a validity period exceeding 398 days (approximately 13 months). Since September 2020, Apple, Google, and Mozilla enforce a maximum certificate validity of 398 days, and certificates with longer lifetimes will be rejected by current versions of Safari, Chrome, and Firefox. Longer validity periods also increase the exposure window if a private key is compromised, as the certificate cannot be superseded until it expires or is revoked.

Impact: Long-lived certificates increase the window of exposure if the private key is compromised. Industry best practice limits certificate lifetime to reduce the impact of key compromise and ensure regular rotation of cryptographic material.

Remediation: Replace the certificate with one having a validity period of 398 days or less. Configure automated certificate renewal (ACME/Let's Encrypt or vendor auto-renewal) to ensure certificates are routinely replaced before expiry. For new certificates, request 90-day validity where possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

LOW SS3-098 — SSL/TLS Certificate: Missing SAN

Description: The TLS certificate does not contain a Subject Alternative Name (SAN) extension. Since 2017, all major browsers require a SAN to be present and have deprecated reliance on the Common Name (CN) field for hostname validation. Certificates without a SAN will cause certificate validation errors in Chrome, Firefox, and Safari for any hostname validation, even if the CN matches. This is a certificate issuance and lifecycle management deficiency.

Impact: A certificate without Subject Alternative Names (SAN) relies solely on the Common Name field for hostname validation. Modern browsers require SAN entries and may reject CN-only certificates, causing service interruptions and security warnings.

Remediation: Replace the certificate with one that includes a valid Subject Alternative Name (SAN) extension containing the intended hostname(s). All modern CAs issue certificates with SAN by default. If using an internal CA, update the certificate template to include the SAN extension.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

INFO SS3-099 — SSL/TLS Certificate: Serial Number Entropy

Description: The TLS certificate serial number has low entropy, suggesting it was generated with a non-random or predictable serial number algorithm. CA/Browser Forum Baseline Requirements (Section 7.1) require that certificate serial numbers contain at least 64 bits of unpredictable entropy. Low-entropy serial numbers may indicate an outdated certificate authority or CA software configuration, and in conjunction with other weaknesses can facilitate certificate collision or impersonation attacks.

Impact: Low entropy in certificate serial numbers indicates weak random number generation in the issuing CA's infrastructure. This can enable serial number prediction attacks that facilitate certificate forgery.

Remediation: Replace the certificate if issued by an internal CA with an outdated serial number generation algorithm. Update the internal CA software or configuration to generate serial numbers with at least 64 bits of CSPRNG-sourced entropy. For externally issued certificates, verify the CA is CA/B Forum compliant.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

MITRE ATT&CK: T1596.003 (Reconnaissance)

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

MEDIUM SS3-100 — SSL/TLS Certificate: Weak Encryption Method

Description: The TLS certificate uses a weak signature algorithm or public key. This includes SHA-1 signed certificates (deprecated since 2017), RSA keys shorter than 2048 bits, DSA keys shorter than 2048 bits, or Elliptic Curve keys shorter than 224 bits. Certificates signed with SHA-1 are vulnerable to chosen-prefix collision attacks (demonstrated by SHAttered). Certificates with short RSA keys are vulnerable to factorisation attacks given current computational resources.

Impact: Certificates signed with weak algorithms (SHA-1, MD5) are vulnerable to collision attacks that allow an attacker to forge a certificate with the same signature, enabling man-in-the-middle attacks that bypass certificate validation entirely.

Remediation: Replace the certificate with one using SHA-256 (or stronger) as the signature algorithm and at minimum RSA-2048 or ECDSA P-256 for the public key. Verify the replacement certificate: openssl x509 -in cert.pem -text | grep 'Signature Algorithm'.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1552.004 (Credential Access)

NIST 800-53: SC-17, IA-5

PCI DSS 4: 4.2.1

LOW SS3-101 — SSL/TLS Session: Long Duration

Description: The TLS server allows session resumption with a session ticket lifetime or session cache timeout exceeding recommended limits (typically more than 24 hours for session tickets or more than 10 hours for session IDs). Long-lived TLS sessions extend the window during which a stolen session ticket or cached session key can be replayed by an attacker to resume a session without re-authenticating. This also limits the effectiveness of forward secrecy when session tickets are encrypted with a long-lived key.

Impact: Excessively long TLS session lifetimes increase the window for session resumption attacks and reduce the effectiveness of forward secrecy. Compromised session tickets remain valid for the entire session duration.

Remediation: Reduce TLS session ticket lifetime to a maximum of 24 hours. Rotate TLS session ticket encryption keys regularly (every 6-12 hours). Set the session cache timeout to a reasonable value. On nginx: ssl_session_timeout 1h; ssl_session_ticket_key rotation should be automated.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

MEDIUM SS3-102 — SSL/TLS Cipher: No Cipher Order Configured

Description: The TLS server does not enforce server-side cipher suite ordering, instead accepting the client's preferred cipher suite. Without server-side cipher preference (SSLHonorCipherOrder), a client can negotiate a weak or deprecated cipher suite even if stronger ciphers are available. This allows a downgrade by a malicious client or a MITM that manipulates ClientHello cipher preferences. Server-side ordering ensures the strongest mutually supported cipher is always selected.

Impact: Without server-enforced cipher order, the client's cipher preference is used, which may select weaker ciphers over stronger alternatives. An attacker can manipulate the client to negotiate weak ciphers through downgrade attacks.

Remediation: Enable server-side cipher suite ordering. On Apache: SSLHonorCipherOrder On. On nginx: ssl_prefer_server_ciphers on. Define a strong cipher list that places AEAD ciphers (ECDHE+AESGCM, ECDHE+CHACHA20) first and excludes weak ciphers entirely.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

MEDIUM SS3-103 — SSL/TLS Ciphers: Obsolete Ciphers

Description: The TLS server supports one or more obsolete cipher suites that have been removed from TLS 1.3 and marked as prohibited or deprecated by RFC 8996 and NIST SP 800-52r2. Obsolete cipher suites include those using NULL encryption, EXPORT key exchange, RC4, MD5 MACs, anonymous DH (aNULL/eNULL), or IDEA. Support for these ciphers indicates the server has not been hardened against known cryptographic attacks and may be negotiating weak encryption with vulnerable or misconfigured clients.

Impact: Obsolete cipher suites such as RC4 and CBC-mode ciphers are vulnerable to known cryptographic attacks including CVE-2013-2566 (RC4 key stream bias) and CVE-2015-2808 (Bar Mitzvah attack). An attacker performing passive traffic capture can recover plaintext from sessions negotiated with these ciphers, compromising the confidentiality of all transmitted data including credentials and session tokens.

Remediation: Audit and update the server's cipher suite configuration. Remove all NULL, EXPORT, RC4, MD5, anon, IDEA, and SEED ciphers. Use a tested cipher string such as the Mozilla TLS configuration generator (ssl-config.mozilla.org) set to 'Intermediate' or 'Modern'. Verify the final cipher list with: openssl s_client -connect <host>:443.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A02:2021

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

CRITICAL SS3-104 — SSL/TLS Vulnerability: Heartbleed (CVE-2014-0160)

Description: The target server is confirmed vulnerable to Heartbleed (CVE-2014-0160). The OpenSSL heartbeat extension does not properly validate the length field in TLS heartbeat requests, allowing an unauthenticated attacker to read up to 64 KB of server process memory per request. Repeated exploitation can expose TLS private keys, session tokens, plaintext credentials, and other sensitive in-memory data without leaving log entries. This vulnerability is distinct from SS3-010 (which covers testssl detection) — this entry is raised when the Scattershot3 Heartbleed probe module independently confirms the vulnerability.

Impact: Heartbleed (CVE-2014-0160) is a critical memory disclosure vulnerability in OpenSSL that allows an attacker to read up to 64KB of server memory per request without authentication or logging. Leaked memory routinely contains private keys, session tokens, and user credentials, enabling complete compromise of the affected server.

Remediation: Upgrade OpenSSL to version 1.0.1g or later (or 1.0.2 branch). Revoke and replace the server's TLS certificate and private key immediately — the private key must be assumed compromised. Invalidate all active user sessions. Reissue any client certificates if a client PKI is in use.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A06:2021

INFO SS3-105 — OS Version Detected

Description: The operating system name and version were detected via service banner analysis, TCP/IP stack fingerprinting, or SMB/RPC responses. The identified OS version is recorded for CVE correlation, EOL status assessment, and engagement documentation. OS version information guides patch level assessment in subsequent phases.

Remediation: This is an informational finding. Review the detected OS version against vendor support timelines. Initiate patch level assessment to confirm OS patch currency. Suppress OS version information from public-facing service banners where possible.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

CRITICAL SS3-106 — OS End-of-Life

Description: The operating system running on this host has reached End-of-Life (EOL) status and is no longer receiving security updates or patches from the vendor. EOL operating systems accumulate unpatched critical vulnerabilities indefinitely and are frequently targeted by automated exploit tools and ransomware families. Any new vulnerability disclosed after the EOL date will remain permanently unpatched on this host, representing an ever-growing attack surface.

Remediation: Upgrade the operating system to a supported version immediately. If upgrade is not immediately feasible, isolate the host from untrusted networks, implement compensating controls (host-based IPS, network segmentation, application allowlisting), and create an urgent remediation plan with a defined timeline.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, SA-22, CM-8

PCI DSS 4: 6.3.3, 12.3.4

HIGH SS3-107 — OS End-of-Life (Extended Support)

Description: The operating system is within its Extended Support (or Extended Security Updates) period, meaning the vendor continues to provide security patches but only under a paid extended support programme or with limited scope. Standard feature updates and non-security bug fixes may no longer be available. Extended support is a transitional state — the OS will reach full EOL at the extended support end date, and migrations to supported platforms should be planned urgently.

Remediation: Plan and execute an OS upgrade to a current, fully supported version within the extended support window. Verify that extended support is active and patches are being applied. Treat any end of extended support date as a hard deadline for migration and allocate project resources accordingly.

Effort: High

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: SI-2, SA-22, CM-8

PCI DSS 4: 6.3.3, 12.3.4

INFO SS3-108 — Software Version Detected

Description: A specific software version was detected on the target host via service banner, HTTP header, or application response fingerprinting. The detected version is recorded for CVE correlation, EOL status assessment, and public exploit research. Software version disclosure aids an attacker in selecting targeted exploit tooling without active exploitation.

Impact: Disclosed software versions allow an attacker to search vulnerability databases for known CVEs affecting that specific version, reducing the effort required for targeted exploitation. Version information also reveals the organization's patching cadence and maintenance practices.

Remediation: This is an informational finding. Cross-reference the detected version against the NVD and vendor security bulletins for known vulnerabilities. Suppress version information from service banners and HTTP headers where possible to reduce information exposure.

Effort: Low

CVSS Vector: N/A

OWASP Web: N/A

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: CM-7, SI-12

PCI DSS 4: 6.2.4

HIGH SS3-109 — Known Vulnerability

Description: A known vulnerability was identified in a service, application, or operating system component on the target host, matched by version fingerprint or active probe against a vulnerability database. The associated CVE, affected component, version, and evidence are recorded in the finding details. Known vulnerabilities matched by version fingerprint may or may not be exploitable depending on the specific build, configuration, or mitigating controls present.

Remediation: Apply the vendor-supplied patch or upgrade for the identified CVE. Verify the patch resolves the specific CVE by checking the vendor security advisory. If patching is not immediately possible, implement compensating controls (network segmentation, WAF, IDS/IPS signatures) and prioritise remediation based on CVSS score and exploitability.

Effort: Medium

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1210 (Lateral Movement)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3

HIGH SS3-110 — Vulners CVE Match

Description: The Vulners vulnerability intelligence API returned a CVE match for the service version detected during port scanning. Vulners correlates Nmap service version banners against a comprehensive database of public CVEs and exploits. The reported CVSS score, CVE identifier, and exploit availability are drawn from the Vulners API response and are recorded in the finding evidence. The actual exploitability may vary depending on target configuration, patch level, and compensating controls.

Remediation: Review the specific CVE(s) identified and apply vendor patches. Consult the NVD entry and vendor security advisory for detailed remediation guidance. Prioritise findings with associated public exploits. Verify patch currency via authenticated vulnerability scanning after remediation.

Effort: Medium

CVSS Vector: N/A

OWASP Web: OWASP-A06:2021

MITRE ATT&CK: T1190 (Initial Access), T1210 (Lateral Movement)

NIST 800-53: SI-2, RA-5, CM-8

PCI DSS 4: 6.3.3

INFO SS-001 — [Nuclei] {title}

INFO SS-002 — Apache Tomcat Manager Login Page Detected: {url}

INFO SS-003 — Discovery: Default Webpage

INFO SS-004 — Deprecated Protocol Enabled: {_norm_proto}

INFO SS-005 — Deprecated Protocol Enabled: {_TESTSSL_PROTO_IDS[_tsf_id]}

INFO SS-006 — Deprecated Protocol Enabled: {proto}

INFO SS-007 — EOL Software (Extended Support): {software_name} {version}

INFO SS-008 — EOL Software: {software_name} {version}

INFO SS-009 — Insecure Protocol Detected: {_insec_name}

Impact: Unencrypted protocol services expose all transmitted data to passive interception and active manipulation by network-level attackers. Credentials, tokens, and business data are transmitted in cleartext.

INFO SS-010 — IPMI Cipher Suite 0 Auth Bypass Confirmed — user={user}

INFO SS-011 — Known Vulnerability: {software_name} {version} — {cve_desc}

INFO SS-012 — libSSH Authentication Bypass (CVE-2018-10933) — v{ver}

INFO SS-013 — Metasploit Module Available: {cve}

INFO SS-014 — Missing Security Header: {header_name}

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks. Each absent header represents a defense-in-depth layer that an attacker can bypass.

INFO SS-015 — MySQL CVE-2012-2122 Authentication Bypass Risk (v{server_ver})

INFO SS-016 — NFS Export Enumerated: {_export_path}

INFO SS-017 — OS End-of-Life (Extended Support): {label}

INFO SS-018 — OS End-of-Life: {label}

INFO SS-019 — OS Version Detected: {final_os}

INFO SS-020 — Public Exploit Available: {cve}

INFO SS-021 — Responder Captured {ht} Hashes

INFO SS-022 — Responder Captured {proto} Credentials

INFO SS-023 — SMB Share Enumerated: \\\\{ip}\\{share}

INFO SS-024 — SMB Share Exists (No Access): {share_name}

INFO SS-025 — SMB Share Read Access: {share_name}

INFO SS-026 — Software Version Detected: {_sw_label}

Impact: Disclosed software versions allow an attacker to search vulnerability databases for known CVEs affecting that specific version, reducing the effort required for targeted exploitation. Version information also reveals the organization's patching cadence and maintenance practices.

MEDIUM SS-027 — SSL/TLS Ciphers: Obsolete Ciphers

INFO SS-028 — SSL/TLS Vulnerability (Potential): {_tsf_id}

INFO SS-029 — SSL/TLS Vulnerability: {_tsf_id}

INFO SS-030 — SSL/TLS Vulnerability: {name}

INFO SS-031 — Valid Credentials via Brute Force ({svc.upper()})

INFO SS-032 — VMware ESXi Management Interface Exposed{ver_str}{build_str}

INFO SS-033 — Vulners: {cve_id} (CVSS {score})

INFO SS-034 — WordPress Core Vulnerability: {vuln_title[:80]}

INFO SS-035 — WordPress Plugin Vulnerability: {vuln_title[:65]} ({plugin_slug})

INFO SS-036 — WordPress Theme Vulnerability: {vuln_title[:70]} ({theme_slug})

INFO SS-037 — FTP Anonymous Login Permitted

INFO SS-038 — Heartbleed (CVE-2014-0160)

INFO SS-039 — Heartbleed (CVE-2014-0160) Vulnerability Detected

Remediation: Upgrade OpenSSL to 1.0.1g or later (or 1.0.2 branch). Revoke and reissue all TLS certificates that were in use on affected systems. Rotate all credentials (passwords, session tokens, private keys) that may have been exposed. Consider notifying affected users.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A06:2021 – Vulnerable and Outdated Components

MITRE ATT&CK: T1552 (Credential Access), T1040 (Credential Access)

NIST 800-53: SI-2, SC-8, RA-5

PCI DSS 4: 6.3.3

CISA KEV

INFO SS-040 — Discovery: Hostname

Impact: Discovered hostnames reveal the hosting provider and infrastructure relationships, enabling an attacker to fingerprint the technology stack and identify potential attack vectors specific to that platform. This reconnaissance data is a prerequisite for targeted exploitation and social engineering campaigns.

Remediation: Informational finding — no immediate remediation required. Ensure discovered hostnames and subdomains are included in the asset inventory and covered by patch management and security scanning. Decommission or remove DNS records for unused or orphaned subdomains to prevent subdomain takeover.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

MITRE ATT&CK: T1590.001 (Reconnaissance)

NIST 800-53: CM-8, RA-2

PCI DSS 4: 12.5.1

INFO SS-041 — LLMNR/NBT-NS Broadcast Poisoning Possible

Remediation: Disable LLMNR and NBT-NS via Group Policy. Require mutual authentication (SMB signing). Enable Extended Protection for Authentication (EPA). Deploy network monitoring to detect Responder activity.

Effort: Low

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1557.001 (Collection)

NIST 800-53: IA-3, SC-8, CM-7

PCI DSS 4: 1.3.2, 2.2.4

INFO SS-042 — Misconfigured Secure Cookie Attribute: SameSite

Remediation: Set HttpOnly, Secure, and SameSite=Lax (or Strict) attributes on all cookies containing session tokens or sensitive values. For SameSite=None (cross-site use cases), always pair with the Secure flag. Review all Set-Cookie directives in application responses systematically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

INFO SS-043 — Missing Secure Cookie Attribute: HttpOnly

Remediation: Set HttpOnly, Secure, and SameSite=Lax (or Strict) attributes on all cookies containing session tokens or sensitive values. For SameSite=None (cross-site use cases), always pair with the Secure flag. Review all Set-Cookie directives in application responses systematically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

INFO SS-044 — Missing Secure Cookie Attribute: SameSite

Remediation: Set HttpOnly, Secure, and SameSite=Lax (or Strict) attributes on all cookies containing session tokens or sensitive values. For SameSite=None (cross-site use cases), always pair with the Secure flag. Review all Set-Cookie directives in application responses systematically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

INFO SS-045 — Missing Secure Cookie Attribute: Secure

Remediation: Set HttpOnly, Secure, and SameSite=Lax (or Strict) attributes on all cookies containing session tokens or sensitive values. For SameSite=None (cross-site use cases), always pair with the Secure flag. Review all Set-Cookie directives in application responses systematically.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1539 (Collection), T1185 (Collection)

NIST 800-53: SC-8, IA-5, SC-23

PCI DSS 4: 6.4.1, 6.5.10

INFO SS-046 — Missing Security Headers

Impact: Missing HTTP security headers reduce the browser's ability to enforce security boundaries, potentially exposing the application to client-side attacks including XSS, clickjacking, and MIME-type confusion. Implementing these headers is a low-effort, high-value hardening measure.

INFO SS-047 — MSSQL Vulnerability (msdat)

Remediation: Disable or rename the SA account; set a strong password if it must remain enabled. Disable xp_cmdshell stored procedure. Restrict MSSQL port (1433/1434) to application servers only. Apply all SQL Server security patches. Enforce Windows Authentication mode where possible.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7

PCI DSS 4: 8.2.1, 8.3.1

INFO SS-048 — Open Port

Impact: Each discovered open port represents an accessible network service and a potential entry point for attackers.

INFO SS-049 — Discovery: Open Ports

Impact: Identified open ports map the external attack surface and reveal which services are accessible from the network. Each open port is a potential entry point; services on unexpected ports may indicate shadow IT or misconfigured infrastructure.

INFO SS-050 — Oracle Database Vulnerability (odat)

Remediation: Change all Oracle default credentials immediately. Apply all Oracle Critical Patch Updates. Restrict Oracle listener port (1521) to application servers only. Disable Oracle TNS listener remote administration. Implement Oracle Database Vault to restrict privileged access.

Effort: Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078 (Initial Access), T1190 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-7, SI-2

PCI DSS 4: 8.2.1, 8.3.1, 6.3.3

INFO SS-051 — Plaintext Credentials in Web File

INFO SS-052 — Reflected Cross-Site Scripting (XSS)

Remediation: Encode all output in the appropriate context (HTML, JS, CSS, URL). Use Content Security Policy headers. Validate and sanitize input server-side.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1189 (Initial Access), T1059.007 (Execution)

NIST 800-53: SI-10, SC-18

PCI DSS 4: 6.2.4

INFO SS-053 — Responder Captured Plaintext Credentials

INFO SS-054 — SMB Signing Disabled or Not Required

INFO SS-055 — SNMP Default Community String Accepted

INFO SS-056 — SQL Injection (Error-Based)

Remediation: Use parameterized queries or prepared statements. Never concatenate user input into SQL strings. Apply least-privilege DB accounts. Deploy a WAF with SQLi rules.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A03:2021 – Injection

OWASP API: API3:2023 – Injection

MITRE ATT&CK: T1190 (Initial Access), T1059 (Execution)

NIST 800-53: SI-10, SA-11, RA-5

PCI DSS 4: 6.2.4, 6.3.2

INFO SS-057 — Discovery: SSL/TLS Certificate

Impact: Certificate details including issuer, validity period, subject alternative names, and key parameters provide an attacker with infrastructure intelligence. This information reveals hosting relationships, internal hostnames, and certificate management practices that inform targeted attacks.

INFO SS-058 — SSL/TLS Certificate: Self-Signed

Impact: Self-signed certificates are not validated by any trusted certificate authority, meaning clients cannot verify the server's identity. An attacker can trivially generate their own self-signed certificate and perform man-in-the-middle attacks without detection.

INFO SS-059 — SSL/TLS Ciphers: No Cipher Order Configured

INFO SS-060 — SSL/TLS DNS: Missing CAA Record

Impact: Without a CAA (Certificate Authority Authorization) DNS record, any certificate authority can issue certificates for the domain. An attacker who compromises a less-secure CA or exploits a CA validation flaw can obtain a legitimate certificate for the domain, enabling transparent man-in-the-middle attacks that bypass certificate validation.

Remediation: Add a DNS CAA record for the domain restricting certificate issuance to your approved CAs. Include an iodef entry to receive notifications of unauthorised issuance attempts. Propagate the record to all DNS zones including subdomains that have independent certificate requirements.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

OWASP Web: A05:2021 – Security Misconfiguration

MITRE ATT&CK: T1588.004 (Resource Development)

NIST 800-53: SC-20, SC-23

PCI DSS 4: 4.2.1

INFO SS-061 — SSL/TLS Vulnerability: Lucky13 [UNCONFIRMED]

Impact: LUCKY13 (CVE-2013-0169) is a timing side-channel attack against CBC-mode cipher suites in TLS. By measuring the time taken to process specially crafted records, an attacker can recover plaintext bytes from encrypted sessions. While practical exploitation requires significant network access and is mitigated by modern TLS implementations, the presence of vulnerable cipher suites indicates incomplete hardening.

INFO SS-062 — SSL/TLS Vulnerability: insecure_redirect

INFO SS-063 — SSL/TLS Vulnerability: ipv4_in_header

INFO SS-064 — SSL/TLS Vulnerability: secure_client_renego

INFO SS-065 — SSL/TLS Vulnerability: TLS_misses_extension_23

INFO SS-066 — Weak Cipher Category Offered

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

INFO SS-067 — SSL/TLS Ciphers: Weak Cipher

Remediation: Disable SSLv2, SSLv3, TLS 1.0, and TLS 1.1. Remove NULL, EXPORT, RC4, DES, 3DES, and ANON cipher suites. Enable server cipher order preference. Configure TLS session tickets securely or disable. Use testssl.sh or SSLLabs to validate. Require TLS 1.2 as minimum with TLS 1.3 preferred.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2021 – Cryptographic Failures

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-28, CM-6

PCI DSS 4: 4.2.1, 2.2.4

INFO SS-068 — Weak or Default Credentials Accepted

Remediation: Change all default credentials immediately on deployment. Enforce password change on first login. Maintain an asset inventory to track devices/services with known default credentials.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API2:2023 – Broken Authentication

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.1

CISA KEV

HIGH SS3-179 — SSH Vulnerability: {cve_id}

Description: ssh-audit matched the SSH server's banner against its built-in CVE database and identified one or more known vulnerabilities affecting the running version of OpenSSH, Dropbear, or Tectia SSH. The CVE ID, CVSS score, and a short description are recorded in the finding Output field; full details are available in the saved ssh-audit JSON report.

Impact: Depending on the specific CVE, an attacker may achieve remote code execution, authentication bypass, user enumeration, host-key spoofing, denial of service, or memory disclosure. Banner-matched CVEs are pre-exploit indicators — the host running an affected version is the necessary precondition for exploitation, even when no public PoC has been tested against this specific deployment.

Remediation: Patch the SSH server to a release that fixes the CVE. For OpenSSH, upgrade via the operating system package manager (apt / dnf / pkg / yum). For embedded SSH stacks (Dropbear, Tectia, network appliances), apply vendor firmware updates. Where patching is not immediately feasible, restrict SSH access to trusted source IPs via firewall and monitor authentication logs for exploit attempts.

Effort: Moderate

NIST 800-53: SC-8, SC-13, SI-2

INFO SS3-180 — SSH Configuration: Algorithm Hardening

Description: ssh-audit reports informational-severity recommendations for the SSH server's algorithm configuration. These are not vulnerabilities but represent opportunities to harden the configuration further by adding modern algorithms or removing older but still-secure ones.

Impact: No direct impact at this severity. Addressing these recommendations improves the long-term cryptographic posture of the SSH service and reduces the surface for future downgrade or algorithm-confusion attacks as cryptographic best-practice evolves.

Remediation: Review the ssh-audit recommendations in the Output field. Update sshd_config (or vendor-equivalent) to add the recommended modern algorithms (e.g. sntrup761x25519-sha512@openssh.com, curve25519-sha256) and remove deprecated algorithms not required for legacy client compatibility. Restart sshd and re-run ssh-audit to confirm the recommendations have been resolved.

Effort: Moderate

NIST 800-53: SC-8, SC-13, SI-2

CRITICAL SS3-181 — VNC: No Authentication Required

Description: The VNC server accepts connections with security type 1 (None), allowing any remote user to connect without providing credentials. The RFB handshake confirms authentication is not enforced.

Impact: An attacker gains full interactive desktop access to the host without any credentials, enabling complete control of the system including file access, application execution, and keystroke capture.

Remediation: Configure VNC to require strong authentication. Use VNC password authentication at minimum; prefer certificate-based or OS-integrated authentication. Restrict VNC access to trusted networks via firewall rules and VPN.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1021 (Lateral Movement)

NIST 800-53: IA-2, AC-17, AC-3

PCI DSS 4: 2.2.1, 8.3.1

INFO SS3-182 — VNC: Authentication Required But Accessible

Description: A VNC service is accessible on the network and requires authentication. While authentication is enforced, the service is reachable for brute-force attacks.

Impact: VNC is reachable on the network, providing a target for credential brute-force attacks and potential exploitation of VNC implementation vulnerabilities.

Remediation: Restrict VNC access to trusted networks. Consider disabling VNC if not required or replacing with a more secure remote access solution.

Effort: Easy

CVSS Vector: N/A

NIST 800-53: AC-17

CRITICAL SS3-183 — WinRM: No Authentication Required

Description: The WinRM (Windows Remote Management) service responded to an unauthenticated SOAP/WS-Management request without requiring credentials, allowing remote command execution.

Impact: An attacker can execute arbitrary commands on the Windows host remotely without credentials, enabling full system compromise, data exfiltration, and lateral movement.

Remediation: Configure WinRM to require authentication (Kerberos or NTLM). Restrict WinRM access via Windows Firewall or GPO to trusted management networks only.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1021.006 (Lateral Movement)

NIST 800-53: IA-2, AC-17, AC-3

PCI DSS 4: 2.2.1, 8.3.1

INFO SS3-184 — Discovery: WinRM Service

Description: The WinRM service is active and responding on the network. Authentication is required but the service is reachable as an attack surface.

Impact: WinRM exposure provides a lateral movement target for attackers with valid credentials. Authentication methods exposed in WWW-Authenticate may guide attack strategy.

Remediation: Restrict WinRM access to trusted management networks via firewall rules. Disable WinRM if not operationally required.

Effort: Easy

CVSS Vector: N/A

MITRE ATT&CK: T1021.006 (Lateral Movement)

NIST 800-53: AC-17

MEDIUM SS3-185 — Insecure Protocol Detected: WinRM (Cleartext)

Description: WinRM is running on port 5985 (HTTP) without TLS encryption. Administrative credentials are transmitted in cleartext or weakly encoded over the network.

Impact: An attacker on the network path can intercept WinRM credentials via packet capture, enabling remote command execution on the managed host.

Remediation: Configure WinRM to use HTTPS (port 5986) with a valid TLS certificate. Disable the HTTP listener on port 5985.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-8, SC-8(1)

PCI DSS 4: 4.2.1

HIGH SS3-186 — Telnet Service Exposed — Cleartext Protocol

Description: A Telnet service is exposed on the network. Telnet transmits all data including credentials in cleartext, making it trivially interceptable.

Impact: All data transmitted via Telnet, including usernames and passwords, can be captured by any attacker with network access. This enables credential theft and subsequent unauthorized access.

Remediation: Disable Telnet and replace with SSH for remote administration. If Telnet is operationally required, restrict access to trusted networks and monitor sessions.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1021 (Lateral Movement)

NIST 800-53: SC-8, SC-8(1), IA-2

PCI DSS 4: 2.2.1, 4.2.1

CRITICAL SS3-187 — Kubernetes API: Unauthenticated Access

Description: The Kubernetes API server is accessible without authentication. Unauthenticated requests can list, create, and modify cluster resources including pods, secrets, and deployments.

Impact: An attacker can fully compromise the Kubernetes cluster — deploying malicious containers, exfiltrating secrets (including cloud credentials and TLS keys), pivoting to other infrastructure, and achieving persistent backdoor access.

Remediation: Enable RBAC and configure API server authentication (certificates, OIDC, or webhook). Restrict API access to authorized networks. Never expose the API server to untrusted networks.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1610 (Execution), T1552.007 (Credential Access)

NIST 800-53: IA-2, AC-3, AC-6

PCI DSS 4: 2.2.1, 7.2.1

CRITICAL SS3-188 — Kubelet API: Unauthenticated Access

Description: The Kubelet API on port 10250 is accessible without authentication, allowing direct interaction with containers running on the node.

Impact: An attacker can list running pods, execute commands inside containers, and exfiltrate data from any container on the node without any credentials.

Remediation: Enable kubelet authentication and authorization (--authentication-token-webhook, --authorization-mode=Webhook). Disable the read-only port (10255).

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1609 (Execution)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 2.2.1, 7.2.1

INFO SS3-189 — Kubernetes API Endpoint Detected

Description: A Kubernetes API endpoint was detected on the network. Authentication is enforced but the endpoint's presence confirms a Kubernetes deployment.

Impact: Confirms Kubernetes infrastructure for further targeted attacks. Version information may aid CVE exploitation.

Remediation: Ensure the Kubernetes API is not exposed to untrusted networks. Verify RBAC is properly configured.

Effort: Easy

CVSS Vector: N/A

NIST 800-53: CM-8

HIGH SS3-190 — Rsync: Anonymous Module Access

Description: The rsync daemon allows anonymous listing and potentially read/write access to shared modules without authentication.

Impact: An attacker can enumerate and download files from shared rsync modules, potentially accessing configuration files, credentials, source code, or sensitive data. Write access enables malware deployment.

Remediation: Configure rsync modules to require authentication (auth users + secrets file). Restrict access by IP via hosts allow/deny. Disable rsync if not required.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1039 (Collection)

NIST 800-53: AC-3, AC-6

PCI DSS 4: 7.2.1

HIGH SS3-191 — Java RMI Registry Exposed

Description: A Java RMI registry is exposed on the network. The JRMI handshake was confirmed. Exposed RMI registries are vulnerable to deserialization attacks via ysoserial payloads.

Impact: An attacker can exploit Java deserialization vulnerabilities to achieve remote code execution on the server. Exposed RMI registries are a well-known exploitation vector with readily available tooling.

Remediation: Restrict RMI registry access to localhost or trusted networks via firewall rules. Implement JMX authentication. Use serialization filters (JEP 290) to prevent deserialization attacks.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A08:2021

MITRE ATT&CK: T1203 (Execution)

NIST 800-53: SI-10, AC-3

PCI DSS 4: 6.2.4

CRITICAL SS3-192 — Memcached: Unauthenticated Access

Description: Memcached is accessible without authentication. The 'stats' command returned data successfully, confirming no authentication is configured.

Impact: An attacker can read and modify cached data (including session tokens, credentials, and application data), flush the cache to cause a denial of service, or use the server for DDoS amplification attacks.

Remediation: Enable SASL authentication for Memcached. Bind to localhost or trusted interfaces only. Implement firewall rules to restrict access. Consider Memcached with TLS (1.5.13+).

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: IA-2, AC-3, SC-7

PCI DSS 4: 2.2.1, 8.3.1

HIGH SS3-193 — Elasticsearch: Unauthenticated Access

Description: Elasticsearch is accessible without authentication. Cluster health, indices, and all stored data can be queried and modified by any network-accessible client.

Impact: An attacker can read, modify, or delete all indexed data which may include PII, credentials, logs, and business-critical information. The cluster can also be used as a data exfiltration staging point.

Remediation: Enable Elasticsearch security features (X-Pack Security or OpenSearch Security). Configure TLS and role-based access control. Bind to localhost or trusted interfaces only.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1213 (Collection)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 2.2.1, 7.2.1

HIGH SS3-194 — MQTT Broker: No Authentication Required

Description: The MQTT broker accepted a CONNECT packet without credentials (CONNACK return code 0x00), confirming no authentication is required.

Impact: An attacker can subscribe to all topics to intercept sensitive IoT/SCADA telemetry data, and publish malicious messages to manipulate connected devices or trigger unsafe actuator commands.

Remediation: Enable MQTT authentication with username/password or client certificates. Configure ACLs to restrict topic access per client. Enable TLS encryption.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1071.001 (Command and Control)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 2.2.1

INFO SS3-195 — MQTT Broker Detected

Description: An MQTT broker was detected on the network. Authentication is enforced (CONNACK rejected unauthenticated connection).

Impact: Confirms an MQTT deployment for further targeted testing. The broker may be part of IoT or SCADA infrastructure.

Remediation: Verify MQTT broker authentication and ACLs are properly configured. Ensure TLS is enabled for production deployments.

CVSS Vector: N/A

NIST 800-53: CM-8

CRITICAL SS3-196 — RabbitMQ: Default Credentials (guest/guest)

Description: The RabbitMQ management UI is accessible with default credentials (guest/guest). The management API returned cluster overview data confirming full administrative access.

Impact: An attacker gains full administrative control of the message broker — able to read, modify, and delete message queues, create new users, access published messages containing potentially sensitive data, and disrupt message-dependent applications.

Remediation: Change or delete the default guest account immediately. Create named accounts with strong passwords and least-privilege permissions. Restrict management UI access to trusted networks.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1078 (Persistence)

NIST 800-53: IA-5, IA-5(1)

PCI DSS 4: 2.1.1, 8.3.6

INFO SS3-197 — RabbitMQ Management UI Exposed

Description: The RabbitMQ management UI on port 15672 is accessible on the network. Default credentials were rejected, indicating custom authentication is in place.

Impact: The management interface is a brute-force target. Successful authentication provides full administrative control of the message broker.

Remediation: Restrict RabbitMQ management UI access to trusted management networks. Ensure strong authentication is configured.

Effort: Easy

CVSS Vector: N/A

NIST 800-53: AC-17

INFO SS3-198 — AMQP Service Detected

Description: An AMQP service was detected on port 5672. The protocol header exchange confirmed the service accepts AMQP 0-9-1 connections.

Impact: Confirms message broker infrastructure for further targeted testing.

Remediation: Verify AMQP authentication is properly configured. Restrict AMQP access to authorized clients only.

CVSS Vector: N/A

NIST 800-53: CM-8

MEDIUM SS3-199 — POP3: STARTTLS Not Supported

Description: The POP3 server on port 110 does not advertise STLS capability in its CAPA response, meaning email retrieval credentials are transmitted in cleartext.

Impact: Email credentials transmitted over POP3 without TLS can be intercepted by any attacker on the network path, enabling unauthorized mailbox access.

Remediation: Enable STARTTLS on the POP3 server or migrate to POP3S (port 995). Ensure TLS 1.2+ with strong cipher suites.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-8(1)

PCI DSS 4: 4.2.1

MEDIUM SS3-200 — IMAP: STARTTLS Not Supported

Description: The IMAP server on port 143 does not advertise STARTTLS capability in its CAPABILITY response, meaning email credentials are transmitted in cleartext.

Impact: Email credentials transmitted over IMAP without TLS can be intercepted by any attacker on the network path, enabling unauthorized mailbox and email content access.

Remediation: Enable STARTTLS on the IMAP server or migrate to IMAPS (port 993). Ensure TLS 1.2+ with strong cipher suites.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1040 (Credential Access)

NIST 800-53: SC-8, SC-8(1)

PCI DSS 4: 4.2.1

CRITICAL SS3-201 — Cloud Metadata Endpoint Accessible

Description: The cloud instance metadata endpoint (169.254.169.254) is accessible from an internal web service, indicating potential SSRF vulnerability or misconfigured network controls.

Impact: An attacker can extract cloud IAM temporary credentials, enabling full compromise of the cloud environment — lateral movement to other cloud services, data exfiltration from S3/Blob/GCS, and privilege escalation.

Remediation: Implement IMDSv2 (AWS) requiring session tokens. Block outbound access to 169.254.169.254 from application containers. Implement network policies restricting metadata endpoint access.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

OWASP Web: OWASP-A10:2021

OWASP API: OWASP-API10:2023

MITRE ATT&CK: T1552.005 (Credential Access)

NIST 800-53: AC-3, SC-7

PCI DSS 4: 6.2.4

CRITICAL SS3-202 — Jenkins: Unauthenticated Groovy Console (RCE)

Description: The Jenkins Groovy Script Console at /script is accessible without authentication, allowing execution of arbitrary Groovy code on the Jenkins server.

Impact: An attacker achieves immediate remote code execution on the Jenkins server. This enables reading credentials from the Jenkins credential store, modifying CI/CD pipelines for supply chain attacks, pivoting to build targets, and establishing persistent backdoors.

Remediation: Immediately restrict access to the Jenkins Script Console (/script) by configuring authentication. Enable Jenkins security realm and authorization strategy. Restrict access by IP at the network level.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1059 (Execution), T1195.002 (Initial Access)

NIST 800-53: IA-2, AC-3, AC-6

PCI DSS 4: 2.2.1, 6.2.4

HIGH SS3-203 — Jenkins: Unauthenticated Management Console

Description: The Jenkins management console at /manage is accessible without authentication, exposing system configuration, plugin management, and credential stores.

Impact: An attacker can view and modify system configuration, install malicious plugins, access stored credentials, and manipulate build infrastructure.

Remediation: Configure Jenkins authentication and authorization. Restrict /manage access to authenticated administrators only. Enable a security realm.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: OWASP-A01:2021

MITRE ATT&CK: T1087 (Discovery)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 2.2.1

HIGH SS3-204 — Kerberoastable Service Accounts Identified

Description: Service accounts with registered Service Principal Names (SPNs) were identified via Kerberos TGS-REP ticket requests. The extracted TGS tickets are crackable offline.

Impact: An attacker can request TGS tickets for SPN-registered service accounts and crack them offline with hashcat/john. Compromised service accounts often have elevated privileges, enabling domain privilege escalation.

Remediation: Use Group Managed Service Accounts (gMSA) with automatically rotated 120-character passwords. For legacy SPNs, enforce 25+ character passwords. Use AES256 encryption for Kerberos tickets. Monitor for TGS-REQ anomalies.

Effort: Significant

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

MITRE ATT&CK: T1558.003 (Credential Access)

NIST 800-53: IA-5, IA-5(1), AC-2

PCI DSS 4: 8.3.6, 8.6.3

MEDIUM SS3-205 — LDAP: Anonymous Enumeration — Users and Groups Discovered

Description: LDAP anonymous bind is permitted and was used to enumerate Active Directory users, groups, and password policies. User/group data was extracted without credentials.

Impact: An attacker obtains a complete user and group listing for targeted attacks: password spraying, social engineering, and identifying privileged accounts. Password policy details inform brute-force strategy.

Remediation: Disable anonymous LDAP binds. Configure the domain controller to require authenticated binds (dsHeuristics). Implement network segmentation to restrict LDAP access to authorized clients.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1087 (Discovery), T1069 (Discovery)

NIST 800-53: AC-14, AC-3

PCI DSS 4: 7.2.1

CRITICAL SS3-206 — SMBv3 Remote Code Execution (CVE-2020-0796)

Description: The host is vulnerable to CVE-2020-0796 (SMBGhost), a buffer overflow in SMBv3 compression handling in Windows 10 (1903/1909) and Server 2019. Detected via nmap smb-vuln-cve-2020-0796 NSE script.

Impact: An unauthenticated attacker can achieve remote code execution with SYSTEM privileges via a specially crafted SMBv3 compressed packet. This is a wormable vulnerability — no user interaction required.

Remediation: Apply Microsoft security update KB4551762 immediately. Disable SMBv3 compression as a temporary mitigation via PowerShell: Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' DisableCompression -Type DWORD -Value 1.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

MITRE ATT&CK: T1210 (Lateral Movement)

NIST 800-53: SI-2, SI-3

PCI DSS 4: 6.3.3

CISA KEV

CRITICAL SS3-207 — FTP Default Credentials Accepted

Description: The FTP service accepted well-known default or factory-set credentials, granting authenticated access to the file transfer service.

Impact: An attacker with knowledge of default credentials can authenticate to the FTP service, potentially reading sensitive files, uploading malicious content, or using the server as a staging point for lateral movement. Default credentials are among the first things attackers test and are trivially discoverable.

Remediation: Change all FTP credentials from factory defaults to strong, unique passwords. Disable unnecessary FTP accounts. Consider replacing FTP with SFTP (SSH file transfer) for encrypted credential transmission.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1078.001 (Initial Access), T1110.001 (Credential Access)

NIST 800-53: IA-5, AC-7

PCI DSS 4: 8.3.6, 2.1.1

LOW SS3-208 — FTP Brute Force Protection Not Detected

Description: The FTP server did not exhibit rate limiting, account lockout, or connection throttling after multiple rapid failed login attempts.

Impact: Without brute-force protection, an attacker can make unlimited credential guessing attempts against the FTP service at high speed. This significantly reduces the time required to compromise accounts through dictionary attacks or credential stuffing.

Remediation: Configure the FTP server to enforce connection rate limiting and account lockout after a threshold of failed login attempts. Most FTP servers (vsftpd, ProFTPD, Pure-FTPd) support MaxLoginAttempts or equivalent directives. Consider fail2ban as an additional layer.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A07:2021 – Identification and Authentication Failures

MITRE ATT&CK: T1110 (Credential Access)

NIST 800-53: AC-7, SI-4

PCI DSS 4: 8.3.4

MEDIUM SS-069 — Information Disclosure: Internal IP in HTTP Response

Description: The HTTP response body or headers from a web service contain one or more RFC 1918 private IP addresses (10/8, 172.16/12, 192.168/16). This reveals internal network topology to external observers.

Impact: An attacker can map internal network topology, identify backend hosts behind load balancers or proxies, and use disclosed addresses to craft targeted attacks such as SSRF against internal hosts or lateral movement after initial compromise.

Remediation: Configure web servers and application frameworks to suppress internal IP addresses from HTTP responses. Review error pages, debug output, reverse proxy headers, and application-generated content for private address leakage.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A01:2025 Broken Access Control

MITRE ATT&CK: T1018 (Discovery)

NIST 800-53: SC-8, SI-11

PCI DSS 4: 6.5.6

INFO SS-070 — Unnecessary/Outdated Website Available

Description: The website shows indicators of being outdated, abandoned, or unnecessary, such as old copyright dates, under-construction messages, or default server landing pages.

Impact: Outdated websites may contain unpatched vulnerabilities, deprecated frameworks, or unnecessary attack surface that increases the organization's risk profile.

Remediation: Remove or decommission unnecessary websites. Update outdated content and frameworks. Replace default server pages with proper content or restrict access.

Effort: Easy

OWASP Web: A05:2025 Security Misconfiguration

MITRE ATT&CK: T1595 (Reconnaissance)

NIST 800-53: CM-7

PCI DSS 4: 6.3.2

CRITICAL SS-071 — Unauthenticated Docker API Exposed

Description: The Docker Engine API is accessible without authentication. Endpoints such as /v1.24/containers/json and /v1.24/images/json return data freely, allowing enumeration of all containers and images on the host.

Impact: An attacker can create, start, stop, and delete containers, pull arbitrary images, mount the host filesystem via --privileged containers, read secrets and environment variables from running containers, and achieve full host-level remote code execution.

Remediation: Restrict Docker API access to localhost or trusted networks. Enable TLS client certificate authentication. Use Docker's built-in authorization plugins.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1610 (Defense Evasion)

NIST 800-53: AC-3, CM-7

PCI DSS 4: 2.2.2, 7.1.1

CRITICAL SS-072 — PostgreSQL Trust Authentication Enabled

Description: PostgreSQL accepts connections as user 'postgres' without requiring a password, indicating trust authentication is configured in pg_hba.conf for the connecting network.

Impact: Full superuser database access to anyone who can reach the port, allowing data exfiltration, modification, deletion, and potential OS command execution via COPY TO PROGRAM or custom functions.

Remediation: Reconfigure pg_hba.conf to require md5, scram-sha-256, or certificate authentication for all connections. Remove any 'trust' entries for non-local connections.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 8.3.1, 2.2.2

HIGH SS-073 — Unauthenticated CouchDB Access

Description: CouchDB allows unauthenticated access to the /_all_dbs endpoint, revealing the list of all databases on the server.

Impact: An attacker can enumerate all databases, read sensitive data, modify or delete documents, and potentially achieve remote code execution via CouchDB's query server functionality.

Remediation: Configure CouchDB to require authentication for all endpoints. Set require_valid_user = true in the [chttpd] section of local.ini.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3, IA-2

PCI DSS 4: 7.1.1

CISA KEV

HIGH SS-074 — Grafana Unauthenticated API Access

Description: Grafana allows unauthenticated access to API endpoints such as /api/org, exposing organization details, dashboards, and data sources.

Impact: Attackers can view dashboards containing sensitive metrics, enumerate data source configurations (which may include database credentials), and access alerting rules. Anonymous API access can also be leveraged to discover internal infrastructure.

Remediation: Disable anonymous access in grafana.ini by setting [auth.anonymous] enabled = false. Implement authentication for all API endpoints.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1530 (Collection)

NIST 800-53: AC-3

PCI DSS 4: 7.1.1

CISA KEV

CRITICAL SS-075 — Grafana Default Credentials (admin:admin)

Description: Grafana accepts the default credentials admin:admin, granting full administrative access to the Grafana instance.

Impact: Full administrative access to all dashboards, data sources (which may contain database credentials and API keys), alerting rules, user management, and the ability to install plugins that could provide further access to the underlying system.

Remediation: Change the default admin password immediately. Enforce strong password policies and consider implementing SSO/LDAP authentication.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 Identification and Authentication Failures

MITRE ATT&CK: T1078.001 (Initial Access)

NIST 800-53: IA-5

PCI DSS 4: 2.1.1, 8.3.6

HIGH SS-076 — Unauthenticated Kibana Access

Description: Kibana exposes its /api/status endpoint without authentication, revealing version information and system status. Full unauthenticated access may also allow reading Elasticsearch indices.

Impact: Attackers can read Elasticsearch indices containing logs, metrics, and potentially sensitive data. Version disclosure enables targeted vulnerability exploitation. Kibana Dev Tools can be used to execute arbitrary Elasticsearch queries.

Remediation: Enable X-Pack security or Elastic Stack security features. Configure authentication for all Kibana endpoints. Use a reverse proxy with authentication as an additional layer.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1190 (Initial Access)

NIST 800-53: AC-3

PCI DSS 4: 7.1.1

CISA KEV

HIGH SS-077 — Cassandra Unauthenticated CQL Access

Description: Cassandra CQL accepted a STARTUP frame and returned READY without requesting authentication, indicating the PasswordAuthenticator is not enabled.

Impact: Unauthenticated read/write access to all keyspaces and tables. An attacker can exfiltrate data, modify records, create or drop keyspaces, and potentially affect cluster stability.

Remediation: Enable PasswordAuthenticator in cassandra.yaml. Create administrative users with strong passwords and configure role-based access control.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 8.3.1

HIGH SS-078 — Git Repository Exposed via Web

Description: The web server exposes a .git directory. The /.git/HEAD file returns a valid Git ref, indicating the full repository is accessible.

Impact: An attacker can reconstruct the complete source code repository including all commit history, which may contain hardcoded credentials, API keys, database connection strings, internal comments revealing business logic, and configuration for other internal systems.

Remediation: Block access to .git directories in the web server configuration (e.g., Apache: <DirectoryMatch "\.git"> Deny from all </DirectoryMatch>). Deploy without the .git directory or use .gitignore and deployment pipelines.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1213 (Collection)

NIST 800-53: SC-28, CM-7

PCI DSS 4: 6.4.1

MEDIUM SS-079 — HTTP Methods: Unsafe Methods Enabled

Description: The web server allows dangerous HTTP methods such as PUT, DELETE, MOVE, COPY, or PROPFIND as reported by the OPTIONS response Allow header.

Impact: PUT can allow arbitrary file upload (including web shells), DELETE can remove files, MOVE/COPY enable WebDAV file manipulation, and PROPFIND discloses directory structure and metadata. These methods may enable remote code execution or data destruction.

Remediation: Disable unused HTTP methods in the web server configuration. For Apache: use LimitExcept directive. For Nginx: return 405 for non-GET/POST methods.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1505.003 (Persistence)

NIST 800-53: CM-7

PCI DSS 4: 2.2.2

MEDIUM SS-080 — HTTP Methods: Unsafe Methods Enabled

Description: The web server responds to HTTP TRACE requests by echoing the full request back, including all headers.

Impact: The TRACE method can be exploited for Cross-Site Tracing (XST) attacks, which combine XSS with TRACE to steal HTTP authentication credentials and cookies even when HttpOnly is set.

Remediation: Disable the TRACE method in the web server configuration. Apache: TraceEnable Off. Nginx: does not support TRACE by default.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: CM-7

PCI DSS 4: 2.2.2

MEDIUM SS-081 — {_status_label} Page Exposed

Description: The Apache server-status or server-info page is publicly accessible, exposing detailed server information including version, uptime, active connections, client IPs, and request URIs.

Impact: Reveals internal IP addresses, active request URIs (which may contain session tokens or API keys), client connections, server configuration details, and loaded modules. This information facilitates targeted exploitation.

Remediation: Restrict access to mod_status and mod_info via Apache configuration (<Location /server-status> Require local </Location>) or disable them entirely.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SC-28, CM-7

PCI DSS 4: 2.2.2

LOW SS-082 — Information Disclosure: Internal Hostname in HTTP Response

Description: The HTTP response contains internal hostnames matching common internal TLD patterns (.local, .internal, .corp, .lan, .intranet, .private, .home, .localdomain).

Impact: Internal hostname disclosure reveals the internal naming convention, domain structure, environment names (dev/staging/prod), and infrastructure layout. This aids reconnaissance and social engineering attacks.

Remediation: Remove internal hostnames from HTTP response headers, error pages, and application output. Use generic external-facing hostnames.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SC-28

PCI DSS 4: 6.4.1

MEDIUM SS-083 — Debug Endpoint Exposed: {_dbg_label}

Description: A debug or management endpoint (e.g., /actuator, /actuator/env, /debug, /__debug__, /console) is accessible and returns diagnostic information.

Impact: Debug endpoints expose environment variables (which may contain credentials and API keys), database connection strings, application configuration, stack traces, and internal application state. Spring Boot Actuator /env can reveal secrets; H2 Console at /console can enable SQL injection.

Remediation: Disable debug endpoints in production environments. For Spring Boot: restrict actuator endpoints via management.endpoints.web.exposure.include. For Django: set DEBUG=False.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

OWASP API: API8:2023 Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: CM-7, SC-28

PCI DSS 4: 2.2.2, 6.4.1

HIGH SS-084 — PHP Info Page Exposed

Description: A phpinfo() page is accessible, exposing the complete PHP configuration including loaded modules, file paths, environment variables, and server details.

Impact: phpinfo() reveals the full server configuration, PHP version, loaded extensions, environment variables (which may contain database passwords and API keys), file paths, and operating system details. This enables targeted exploitation of known PHP and module vulnerabilities.

Remediation: Remove phpinfo files from production servers. Disable the phpinfo() function via php.ini: disable_functions = phpinfo.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SC-28, CM-7

PCI DSS 4: 2.2.2

LOW SS-085 — DNS Server Version Disclosed

Description: The DNS server discloses its version string via a CHAOS TXT query for version.bind.

Impact: Software version disclosure enables attackers to identify known vulnerabilities for the specific DNS server version and craft targeted exploits. BIND version disclosure is a common reconnaissance target.

Remediation: Configure the DNS server to suppress or fake version responses. For BIND: options { version "none"; }; For PowerDNS: server-id and version-string settings.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1592.002 (Reconnaissance)

NIST 800-53: SC-28

PCI DSS 4: 2.2.2

MEDIUM SS-086 — SMTP Mailing List Enumeration via EXPN

Description: The SMTP EXPN command is enabled and reveals mailing list membership, disclosing valid email addresses and group membership.

Impact: EXPN reveals valid email addresses and organizational group membership, enabling targeted phishing campaigns, social engineering, and password-spray attacks. Combined with VRFY, it provides a comprehensive user enumeration capability.

Remediation: Disable the SMTP EXPN command or restrict it to authenticated sessions. In Postfix: smtpd_expansion_filter. In Sendmail: PrivacyOptions=noexpn.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.002 (Reconnaissance)

NIST 800-53: SC-28, CM-7

PCI DSS 4: 2.2.2

MEDIUM SS-087 — SSL/TLS Certificate: Hostname Mismatch

Description: The SSL/TLS certificate Common Name (CN) does not match the hostname used to connect, as reported by testssl.sh.

Impact: A hostname mismatch causes browsers and clients to display security warnings. Users may learn to ignore these warnings, making them vulnerable to man-in-the-middle attacks. The mismatch may also indicate a misconfigured or reused certificate.

Remediation: Obtain a certificate that matches the server hostname in the CN or SAN fields. Use wildcard certificates for multiple subdomains.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

INFO SS-088 — Information Disclosure: Sensitive Path in robots.txt

Description: The robots.txt file contains Disallow entries for potentially sensitive paths such as admin panels, backup directories, configuration files, or development endpoints.

Impact: While robots.txt instructs well-behaved crawlers to skip listed paths, it simultaneously advertises them to attackers. Sensitive paths in robots.txt serve as a roadmap for targeted enumeration and exploitation.

Remediation: Review robots.txt entries for sensitive paths. Remove entries that disclose internal structure. Ensure listed paths require authentication regardless of robots.txt.

Effort: Easy

CVSS Vector: N/A

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1592.002 (Reconnaissance)

LOW SS-089 — Information Disclosure: Internal Hostname in SAN

Description: The SSL/TLS certificate includes internal hostnames in its Subject Alternative Names, matching patterns like .local, .internal, .corp, .lan, .intranet, .private.

Impact: Internal hostnames in publicly accessible certificates disclose the internal naming scheme, domain structure, and potentially the existence of internal services. This aids network mapping and targeted attacks against internal infrastructure.

Remediation: Remove internal hostnames from the SAN list in certificates used on public-facing services. Use separate certificates for internal and external services.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1592 (Reconnaissance)

NIST 800-53: SC-28

PCI DSS 4: 4.2.1

MEDIUM SS-090 — UPnP/SSDP Service Responding

Description: The UPnP/SSDP service responded to an M-SEARCH discovery request, revealing device information and service endpoints.

Impact: UPnP can expose device details and allow port forwarding changes without authentication. SSDP has been used in large-scale DDoS amplification attacks. Device information aids targeted exploitation of known firmware vulnerabilities.

Remediation: Disable UPnP if not required. Restrict SSDP (UDP 1900) via firewall rules to trusted networks only. Disable UPnP on routers and IoT devices.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1046 (Discovery)

NIST 800-53: CM-7

PCI DSS 4: 2.2.2

HIGH SS-091 — MongoDB Unauthenticated Access

Description: MongoDB accepted an isMaster query via the native OP_QUERY protocol without requiring authentication, indicating authorization is not enabled.

Impact: Full read/write access to all databases, allowing data exfiltration, modification, deletion, and user creation. MongoDB instances without auth have been widely targeted by ransomware campaigns that delete databases and demand payment.

Remediation: Enable authorization in mongod.conf (security.authorization: enabled). Create administrative users with strong passwords. Bind MongoDB to localhost or trusted interfaces only.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

OWASP Web: A05:2021 – Security Misconfiguration

OWASP API: API8:2023 – Security Misconfiguration

MITRE ATT&CK: T1078 (Initial Access)

NIST 800-53: IA-2, AC-3

PCI DSS 4: 8.3.1

MEDIUM SS3-209 — Directory Listing Enabled

Description: The web server has directory listing enabled, displaying file names, sizes, and modification dates to anyone who requests a directory without an index file.

Impact: Directory listings allow attackers to discover backup files, configuration files, source code, database dumps, and other sensitive content that would otherwise require blind enumeration.

Remediation: Disable directory listing in the web server configuration. Apache: Options -Indexes. Nginx: autoindex off.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OWASP Web: A05:2021 Security Misconfiguration

MITRE ATT&CK: T1083 (Discovery)

NIST 800-53: CM-7

PCI DSS 4: 2.2.2

MEDIUM SS3-210 — SSL/TLS Certificate: Not Trusted

Description: The SSL/TLS certificate is not trusted by common certificate stores, as reported by testssl.sh. This may indicate a self-signed certificate, an expired certificate, or a certificate from an untrusted CA.

Impact: Untrusted certificates cause browser warnings that users learn to ignore, making them vulnerable to man-in-the-middle attacks. This may also indicate an attacker-controlled certificate or a certificate from a compromised CA.

Remediation: Obtain a certificate from a trusted Certificate Authority. Ensure the full certificate chain is properly configured on the server.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

OWASP Web: A07:2021 Identification and Authentication Failures

MITRE ATT&CK: T1557 (Credential Access)

NIST 800-53: SC-17

PCI DSS 4: 4.2.1

MEDIUM SS3-210 — SSL/TLS Forward Secrecy: Not Supported

Description: The server does not offer any cipher suites with forward secrecy (ECDHE or DHE key exchange). Without forward secrecy, compromise of the server's private key allows retroactive decryption of all recorded past sessions.

Impact: An attacker who obtains the server's private key (through theft, legal compulsion, or future cryptanalysis) can decrypt all previously captured TLS traffic. Forward secrecy ensures each session uses ephemeral keys that are discarded, making past sessions safe even if the long-term key is compromised.

Remediation: Configure the server to use only cipher suites that provide forward secrecy (ECDHE or DHE key exchange). Disable static RSA key exchange. TLSv1.3 mandates forward secrecy and should be preferred.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A02:2025 Cryptographic Failures

NIST 800-53: SC-8, SC-12

PCI DSS 4: 4.2.1

LOW SS3-211 — SSH Password Authentication Enabled

Description: The SSH server accepts password-based authentication methods (password and/or keyboard-interactive) alongside public key authentication. Password authentication is susceptible to brute-force attacks and does not enforce multi-factor authentication.

Impact: An attacker can attempt password brute-force attacks against the SSH service. Even with strong passwords, password authentication lacks the cryptographic assurance of key-based authentication and is incompatible with most MFA implementations. Compliance frameworks including CIS Benchmarks and DISA STIGs mandate public-key-only SSH authentication.

Remediation: Disable PasswordAuthentication and ChallengeResponseAuthentication in /etc/ssh/sshd_config. Require public key authentication exclusively. CIS Benchmark and DISA STIG both mandate disabling password-based SSH login.

Effort: Low

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.4

MEDIUM SS3-212 — SSH Password-Only Authentication (No Public Key)

Description: The SSH server accepts only password-based authentication methods (password and/or keyboard-interactive) with no public key authentication available. This is a significant security weakness — the server cannot accept key-based authentication at all, making brute-force the only barrier to unauthorized access.

Impact: Without public key authentication, the SSH server relies entirely on password strength for security. An attacker can mount online brute-force or credential-stuffing attacks with no cryptographic barrier. The absence of public key support also prevents deployment of certificate-based or hardware-token SSH authentication. This configuration violates CIS Benchmark and DISA STIG requirements for SSH hardening.

Remediation: Enable public key authentication and disable PasswordAuthentication and ChallengeResponseAuthentication in /etc/ssh/sshd_config. Generate and deploy SSH key pairs for all authorized users. CIS Benchmark and DISA STIG both mandate public-key-only SSH login.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1110 (Credential Access), T1078 (Initial Access)

NIST 800-53: IA-2, IA-5, CM-6

PCI DSS 4: 8.3.1, 2.2.4

INFO SS3-213 — Discovery: O365 Tenant Detected

Description: The target domain uses Microsoft 365 / Azure AD for email and authentication. MX records point to *.protection.outlook.com or the OpenID configuration endpoint confirms an Azure AD tenant.

Impact: Confirms the organization uses Microsoft 365, enabling targeted O365 account enumeration, credential spray, and phishing attacks against the tenant.

Remediation: Implement conditional access policies, enforce MFA, and configure Azure AD Smart Lockout to mitigate enumeration and credential spray attacks.

Effort: Moderate

MITRE ATT&CK: T1589.002 (Reconnaissance)

NIST 800-53: SC-7

MEDIUM SS3-214 — Enumeration: O365 Account Enumeration

Description: Valid O365 user accounts were confirmed via Azure AD authentication endpoint enumeration. The endpoint returns different responses for valid and invalid accounts, allowing an attacker to confirm which email addresses correspond to active accounts.

Impact: Confirmed valid accounts can be targeted with password spray attacks, credential stuffing, phishing campaigns, and social engineering. This significantly reduces the attacker's search space for credential-based attacks.

Remediation: Implement conditional access policies, enforce MFA on all accounts, configure Azure AD Smart Lockout, and disable legacy authentication protocols that bypass MFA. Monitor Azure AD sign-in logs for enumeration patterns.

Effort: Moderate

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

MITRE ATT&CK: T1589.002 (Reconnaissance), T1110.003 (Credential Access)

NIST 800-53: AC-2, IA-5

PCI DSS 4: 8.2.1

HIGH SS3-215 — Unauthenticated X11 Display Access

Description: An X11 display server accepts connections without authentication. The service responded to either xdpyinfo queries or raw X11 protocol handshake without requiring XAUTH/MIT-MAGIC-COOKIE credentials.

Impact: An attacker can capture screen contents in real-time, inject keystrokes and mouse events, monitor all user activity on the display, and potentially execute arbitrary commands through keystroke injection. This provides full visibility into and control over the user's desktop session.

Remediation: Disable remote X11 connections or enforce XAUTH/MIT-MAGIC-COOKIE authentication. Configure X11 to listen only on localhost (-nolisten tcp). Use SSH X11 forwarding instead of direct X11 connections. Apply firewall rules to block ports 6000-6063 from untrusted networks.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: N/A

MITRE ATT&CK: T1056.001 (Collection), T1113 (Collection), T1021 (Lateral Movement)

NIST 800-53: AC-17, AC-3

PCI DSS 4: 2.2.4

INFO SS3-216 — X11 Display Detected (Authentication Required)

Description: An X11 display server is running but requires authentication to connect. The X11 protocol handshake was rejected with an authentication-required response.

Impact: The X11 service is exposed on the network but properly requires authentication. While the service itself is secured, exposure of X11 ports to untrusted networks increases the attack surface. If authentication credentials are weak or compromised, the display could be accessed remotely.

Remediation: Verify X11 is configured to listen only on localhost unless remote access is required. Use SSH X11 forwarding instead of direct connections. Apply firewall rules to restrict access to X11 ports.

Effort: Easy

CVSS Vector: N/A

OWASP Web: N/A

CRITICAL SS3-217 — Default Credentials: {SERVICE}

Description: brutespray confirmed that a network service accepts default or factory-preset credentials. The service responded with a successful authentication using a well-known username/password combination.

Impact: An attacker can immediately authenticate to the service using widely-known default credentials. Depending on the service, this may provide full administrative access, ability to read/modify data, execute commands, pivot to other systems, or completely compromise the host. Default credentials are among the most commonly exploited vulnerabilities.

Remediation: Change all default credentials immediately. Implement strong, unique passwords for all service accounts. Deploy account lockout policies. Consider disabling unnecessary services entirely.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1078.001 (Persistence), T1110 (Credential Access)

NIST 800-53: IA-5, AC-2

PCI DSS 4: 2.1.1, 8.2.2

HIGH SS3-218 — Weak Credentials: {SERVICE}

Description: brutespray confirmed that a network service accepts weak or easily guessable credentials. The service authenticated successfully with a non-default but weak username/password combination.

Impact: An attacker can authenticate to the service using credentials that are easily guessable or present in common wordlists. This may provide unauthorized access to sensitive data, the ability to modify configurations, or a foothold for lateral movement within the network.

Remediation: Enforce strong password policies with minimum length, complexity, and rotation requirements. Implement account lockout after failed attempts. Deploy multi-factor authentication where possible.

Effort: Easy

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OWASP Web: A07:2021 - Identification and Authentication Failures

MITRE ATT&CK: T1110.001 (Credential Access)

NIST 800-53: IA-5

PCI DSS 4: 8.3.6