NCSC assesses threat to enterprise connected devices
NCSC warns that the growing adoption of Enterprise Connected Devices (ECDs) expands organisations' attack surface, enabling espionage, lateral movement, ransomware and botnet abuse.
Sourcencsc.gov.uk — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2019-19006 as exploited in the wild.
This NCSC assessment, produced with DCMS, evaluates the cyber security threat posed by Enterprise Connected Devices (ECDs) — a broad category spanning end-user devices, enterprise IoT, and distinct enterprise devices such as printers, cameras, VoIP systems and video conferencing equipment. The paper judges it highly likely that ECDs represent an expanding attack surface due to weak vendor security, internet exposure, and their use as pivot points for accessing corporate networks. It draws on multiple case studies to illustrate real-world impact, including exploitation of an unauthenticated VoIP vulnerability (CVE-2019-19006) against ~1,200 organisations, a casino breach via a compromised smart fish tank, the VPNFilter router/NAS botnet, Mirai-based DDoS botnets, LG smart TV ransomware (FLocker), and the Ripple20 supply-chain vulnerabilities affecting the Treck IP stack used across millions of devices.
The report highlights three main threat-actor categories: nation-state actors conducting espionage (citing Russian APT28/STRONTIUM compromising IoT devices like VOIP phones, printers and video decoders across multiple sectors), cybercriminals seeking financial gain via ransomware and DDoS-for-hire, and hacktivist/state-linked groups such as the Russian collective 'Digital Revolution', which leaked documents describing an FSB-linked project to build a Mirai-inspired IoT botnet targeting CCTV and NVR devices. Supply-chain risk is also flagged, referencing NotPetya and SolarWinds as precedent nation-state supply-chain compromises relevant to the ECD ecosystem.
Overall, this is a strategic threat-landscape and awareness paper rather than an incident report — it aggregates known case studies and vulnerabilities to inform organisational risk assessment and supports NCSC/DCMS's Device Security Principles framework. No new indicators of compromise or previously unreported incidents are disclosed; the value is in synthesis and guidance for enterprises deploying IoT/ECD technology.
Mentioned in this report
Source reporting: https://www.ncsc.gov.uk/report/organisational-use-of-enterprise-connected-devices
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs