MT.1087: Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's.

ID	MT.1087
Severity	High
Suite	Mito
Product	Defender
Feature	Exposure Management
Security area	Devices and endpoints
Resource type	Device
User impact of fixing	Low
Effort to fix	Medium
MITRE ATT&CK	T1190
Reads from	Microsoft Graph

What this checks and how to fix it

The query behind this test searches for devices that comply with the following criteria:

• Incoming connections from public IP addresses in last 7 days (internet exposed)
• High or Critical severity CVE’s
• CVE’s must have known exploits
• CVE’s are remotely exploitable over the network
• No user interaction is required to exploit the CVE’s
• EPSS score of CVE must be above 10% (likelihood of exploitation)

NOTE! If devices are placed behind a proxy, they will not be returned in this query by default

Devices that return from these results are possible high-risk devices that could be exploited successfully any time.

How to fix

Review the devices in the list and either patch the severities, or make sure to implement mitigative controls to reduce exposure. If you want to have more details on the exposed devices and their related CVE’s, you can run the following query manually in Advanced Hunting.

---

Mito check. Author: RobbeVandenDaele; contributors: SamErde. Open-source licences.