Infrastructure Blind Spots: Expanding Visibility With Censys

The vdaemon management panel, which is responsible for Cisco’s SD-WAN Manager and Controller, deploys routing policies across all corporate network branches. Scan data records 11,180 such services accessible from the open internet. Interaction with this service without authentication allows one to obtain the client’s organization name, device ID, and site ID before login. The CISA agency has added privilege escalation vulnerabilities in Cisco SD-WAN to the Known Exploited Vulnerabilities (KEV) catalog, and researchers report active exploitation of these flaws. Security professionals should ensure their management systems are not accessible to external requests.

The FSC3000 controller authorizes fuel cards, manages pumps, and stores transaction summaries at gas stations. The console banner of this system reveals the object ID without requiring login, exposing critical information to anyone scanning the network. Although no active campaigns related to this vulnerability have been recorded yet, fuel infrastructure is a documented target for various groups. Companies operating such facilities need to isolate these controllers from the open internet to prevent unauthorized interference.

In the IoT segment, physical security systems pose a serious threat. For instance, reading from the C-Nord security center’s inter-module bus without authorization may return the current alarm status, event history, and key owner names. Meanwhile, issues have been identified with DNVRS-Webs—a background service used by Hikvision digital video recorders for remote configuration. Researchers have previously found critical remote code execution (RCE) vulnerabilities in this manufacturer’s management platform. Internet exposure makes the entire camera fleet vulnerable, so security services must regularly check access settings.

The STOMP messaging protocol used by Apache ActiveMQ and RabbitMQ brokers has a long history as an entry point for ransomware. Groups distributing ransomware (including LockBit) have used early ActiveMQ flaws to gain RDP access, and a specific denial of service (CVE-2026-53916) error was recently disclosed. Another risk is Pigeonhole—the email filtering mechanism by Dovecot. An open instance of this engine provides cybercriminals with a foothold in the infrastructure that solves the logic of corporate email routing. It is important to ensure that message brokers and email filters are updated and protected from external interference.

The expansion of continuous network scanning capabilities proves that hidden internet assets remain one of the main risks for modern businesses. Using new protocols and detection tools from Censys allows security services to identify vulnerabilities in network infrastructure, industrial controllers, and IoT systems before cybercriminals exploit them. A proactive approach and deep visibility of the attack surface are fundamental conditions for reliable corporate perimeter protection.