What can BADCANDY teach enterprises about network security? Learn how to protect edge devices, reduce exposure, and respond to zero-day threats.
Every enterprise has a front door to its network, and for a lot of organizations, that front door is a router, a firewall, or a VPN concentrator sitting quietly at the edge. Network perimeter security is supposed to keep that door locked. The BADCANDY campaign proved just how fast things unravel when it isn’t.
BADCANDY was an implant that attackers dropped onto unpatched Cisco IOS XE devices by exploiting a critical flaw, CVE-2023-20198. Once installed, it gave threat actors a persistent, privileged foothold, no credentials required. Thousands of devices worldwide were hit within days of the flaw becoming public. For teams responsible for edge device security, the incident is still one of the clearest case studies of what happens when a single unpatched box turns into an open door.
Routers and switches aren’t usually where security teams focus their attention. Endpoints, cloud workloads, and identity systems get the budget and the headlines. Meanwhile, the devices that actually sit at the network boundary, quietly routing every packet in and out, often run for years without a firmware update.
That’s exactly what made BADCANDY so effective. Zero-day vulnerabilities like CVE-2023-20198 give attackers a window before a patch even exists. In the BADCANDY campaign, that window was all it took. The flaw sat in the web UI feature of IOS XE and let an attacker create a local account with the highest privilege level available, essentially handing over the keys.
Once inside, the implant didn’t need to phish anyone or move laterally through a dozen systems. It was already sitting on a device that talks to everything. That’s the core danger with internet-facing devices: they’re built to be reachable, which also makes them reachable by attackers scanning the entire internet for exposed management interfaces.
Attackers run mass scans looking for devices with network device security gaps: exposed admin panels, default credentials, or unpatched firmware. A single misconfigured interface, left open to the public internet, is enough to get flagged and probed within hours. Network infrastructure security teams often discover this the hard way, after logs show repeated authentication attempts from unfamiliar regions long before anyone noticed the exposure.
The lesson from BADCANDY isn’t just “patch faster,” though that matters. It’s that the network perimeter has quietly become one of the least monitored parts of most environments, even as it remains one of the most attractive targets.
Enterprises asking how to protect internet-facing network devices from zero-day attacks usually find the answer isn’t a single tool purchase, it’s a shift in how the edge gets treated day to day. There’s no single fix, but a few practices consistently reduce exposure:
None of these steps require a massive budget. They require treating the devices at the edge with the same discipline applied to servers and endpoints.
Most of this comes down to ownership. In many organizations, nobody is specifically responsible for the router sitting at the edge of the network. It falls between the network team, the security team, and vendor management, and in that gap, patches get delayed. Naming a clear owner for perimeter hardware closes that gap faster than any new piece of software would.
Detection is where most organizations fall behind. Learning how to detect vulnerabilities in network infrastructure early is less about buying another scanner and more about pointing existing tools at the parts of the network that usually get skipped. Vulnerability management programs are usually built around scanning servers and applications, not the routers and firewalls sitting between them and the internet. That blind spot is exactly what the BADCANDY campaign exploited.
A few practical habits close that gap. Regularly scan external-facing IP ranges to confirm nothing unexpected is exposed. Cross-reference device firmware versions against vendor advisories on a set schedule instead of waiting for an incident. And treat edge device security as its own category in the asset inventory, not an afterthought bundled in with general IT hardware.
Strong network infrastructure security doesn’t come from a single tool. It comes from visibility into what’s actually reachable from outside, paired with the discipline to act on that visibility before an attacker does.
Smaller teams without a dedicated network security function can still make meaningful progress here. Even a quarterly review of which devices are reachable from outside the organization, cross-checked against the latest vendor advisories, catches most of the exposure that campaigns like BADCANDY rely on. It’s not glamorous work, but it’s the kind of routine maintenance that keeps a minor oversight from turning into a full incident response.
BADCANDY wasn’t especially sophisticated as far as attacks go. It succeeded because the target was overlooked, not because it was clever. That’s the pattern worth remembering: attackers don’t need a novel technique when an old, unpatched device is sitting wide open.
Strengthening network perimeter security doesn’t mean ripping out infrastructure or starting over. It means giving edge devices the same scrutiny given to everything else on the network, closing the gap between what’s exposed and what’s actually being watched.
BADCANDY is an implant that attackers used to gain persistent, privileged access to unpatched Cisco IOS XE devices by exploiting CVE-2023-20198, a critical web UI vulnerability.
The campaign targeted Cisco IOS XE devices with the web UI feature enabled and exposed to the internet, including routers and switches used at the network perimeter of enterprise environments.
CVE-2023-20198 is a critical flaw in Cisco IOS XE’s web UI that let attackers create a local account with the highest privilege level, without needing valid credentials, making it a serious zero-day vulnerability.
Internet-facing devices are reachable by design, which means attackers can scan the entire internet for exposed management interfaces and weak network device security without ever touching an endpoint.
In the BADCANDY case, the implant itself didn’t survive a reboot, but any local accounts the attacker created did. Rebooting alone isn’t a fix, which is why vulnerability management and account audits matter after any suspected compromise.
