Do not fucking expose management interfaces to the Internet.
While infrastructure as code and other approaches to automated configuration management have become increasingly popular, in most organization's IT environments management interfaces - especially when it comes to edge devices such as firewalls, VPNs and other remote access solutions, and security appliances - are still very much present and a vital component that allows administrators to adjust configurations, troubleshoot issues, and grant or revoke access. This core role means that they also tend to be interesting targets for malicious actors.
I was recently confronted with a security incident in a professional capacity, with the case most likely starting with the exploitation of a management interface of a security appliance being accessible from the Internet.

While this was very much not the first time I had to deal with an incident that started out like this, it was (another) reminder that despite the efforts of CERTs, CSIRTs and other organisations (like the Shadowserver Foundation) and contrary to well-known best practices, there are still way, way too many management interfaces accessible from the Internet out there. And by "way too many" I'm not talking about a couple of dozen systems, I'm talking about thousands.
Exposing administrative interfaces to the broader Internet significantly increases the risk profile of your organization. Depending on how lucky you are you have, in the best case, a couple of minutes before automated scanners have located it.
Threat actors tend to run global sweeps to discover well-known admin endpoints or custom ports often used for management interfaces in their default settings. Once a system has been identified, the criminals start trying to get access. Even if they are "just" trying to brute-force or stuff credentials, that's not something I want to allow attackers to do willy-nilly.
Another issue arise from a misconfiguration or (insane) defaults. Many devices , applications, or appliances ship with default credentials that are well-documented (and just as well-known to attackers). When organizations fail to change these credentials, malicious actors gain quick entry.
Whenever I bring up these issues in conversations I inevitably get hit with compliance language, with "technical and organizational measures" that are being taken to "mitigate the risk". Have I mentioned already how much I loathe most pyramid schemes compliance certifications, with everything ISO27xxx being at the absolute forefront? But okay, let's talk about "mitigating risk".
Multi-factor-authentication, MFA, is a very popular method that's being brought up in these discussions. Although it provides a robust defensive layer against standard credential-based attacks, and you should absolutely employ it wherever you can, it can still be bypassed through phishing campaigns that trick users into providing their MFA codes or clicking on malicious links. Attackers also exploit session hijacking techniques where they intercept or steal authenticated sessions, rendering MFA moot once the session is established.
For some, to me, incomprehensible reason people sometimes also argue that the access to the management interface is protected by TLS. I mean, yes, I generally hope that the connection to the management interface is encrypted in one way or the other.
Ensuring that credentials and other information aren't transmitted (because that's what TLS does in this context, it's transport encryption) in clear text is the most basic level of infosec hygiene that I absolutely expect from anyone setting up systems in a professional capacity. Hell, I'd expect this from hobbyists too. But that doesn't help if the underlying application has a logical flaw or if attackers gain access through stolen tokens or legitimate user credentials .. the encryption itself does nothing to stop them.
But maybe I'm lacking technical understanding here and the people putting this argument forward are playing 3D-threat-modelling and are aware of risks that I'm not even able to so.
Assuming for a moment that those measures are effective enough to protect your management interface, that your MFA is foolproof and that now misconfigurations are present .. well, that still doesn't help you if a threat actor can simply circumvent those measures by exploiting a vulnerability in the management interface itself (we're, for the sake of the argument, ignoring vulnerabilities in other parts of a system for the moment). And boy, have there been a lot of those.
How many exactly I don't know, but a cursory search of the Internet, taking around fifteen minutes, returned the following list of vulnerabilities that fit the description of "having been discovered / released in the last twelve months" and "if you have your management interface exposed on the Internet, this one is going to hurt you":
- CVE-2025-23006: Unauthenticated attackers can remotely execute commands with administrative permissions on affected versions of SonicWall SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC); reportedly abused by threat actors
- CVE-2024-53704: Unauthenticated attackers could, under certain circumstances, remotely predict cryptographic tokens and circumvent authentication mechanisms on affected Sonicwall devices; reportedly abused by threat actors
- CVE-2024-47575: Unauthenticated attackers can remotely execute commands with administrative permissions on affected versions of FortiGate FortiManager; reportedly abused by threat actors (for at least three months before publication of the vulnerability)
- CVE-2024-24919: Unauthenticated attackers can remotely extract critical information, such as password-hashes, from affected versions of Check Point Network Security Gateways; reportedly abused by threat actors
- CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893: Unauthenticated attackers can remotely compromise affected versions of Ivanti Connect Secure and Ivanti Policy Secure; reportedly abused by threat actors
- CVE-2024-55591: Unauthenticated attackers could remotely execute commands with administrative permissions on affected versions of FortiOS and FortiProxy; reportedly abused by threat actors
- CVE-2024-0012: Unauthenticated attackers could remotely gain administrator privileges on affected versions of Palo Alto Networks' PAN-OS
- This instance of a fuckup with Zyxel devices that didn't even get a CVE-number.
Please note: The vulnerabilities listed here are only for management interfaces or other ways of administrative access to devices, systems, or services. If I would have included severe or critical vulnerabilities in other components of security products, then this list would have been significantly longer. I also would probably have had a heart attack because of the state of this industry, but that's a topic for another day ..
I'm sure that there are more, similar vulnerabilities in popular products than this list I quickly assembled, as well as an even larger number of issues in the management interfaces of lesser known products.
As the "reportedly abused by threat actors" might suggest, those vulnerabilities aren't Rowhammer, SPECTRE, or MELTDOWN. They aren't academic, vulnerabilities that need very specific conditions to be effectively exploited. Those vulnerabilities are actively exploited, constantly.
No matter if it's Ivanti Connect Secure, Fortinet FortiGate, Citrix NetScaler, or any number of products that are being sold for quite a bit of money out there. Security issues in their management interfaces are exploited and abused, constantly and continuously.
To sum things up: Management interfaces, like all other components of software, have security vulnerabilities. They also happen to sometimes suffer from insane default configuration settings (which often enough aren't changed by lazy admins). On top of that they can be attacked in other ways, such as credential stuffing or good ol' brute force. Once attackers gain access to them you are basically done for, because accessing the management interface of anything is usually a good way to compromise anything below and surrounding it, network-wise.
Which is a long-winded way to repeat what I was already saying with the title of this post: Stop. putting. fucking. management. interfaces. on. the. Internet.

And yes, even despite all of the dangers, problems, risks, and issues I just covered in these paragraphs, I know that there are people that will argue that for one reason or the other they have to make management interfaces available over the Internet, or that they have no technical way to make them unavailable.
Which, despite me being convinced with almost absolute certainty that your case isn't as clear cut as you make it out to be, is fine by me. But please, make the exposure of management interfaces a conscious decision .. you know what, actually not. Do. not. expose. fucking. management. interfaces. to. the. fucking. Internet. - period.

I am aware that my wording, especially the title of this post, may be a bit crass. You could even argue that it's unprofessional - which, luckily, isn't an issue here, because this site is as far from professional as humanly possible.
But I'm all out of ideas when it comes to convincing people that putting management interfaces of any kind out on the Internet. I'm genuinely at the point where I both feel like I'm yelling against clouds, and that it might actually be a prudent course of action to start yelling at people. But I'm doubtful that even that would suffice.
To end this post in a more conciliatory tone: Exposing an administrative or management interface directly to the public Internet is a dangerous practice. The numerous vulnerabilities and real-world incidents highlight how quickly attackers exploit even minor flaws. While technologies like MFA help, they are not a silver bullet - any oversight, misconfiguration, or vulnerability can leave you wide open.
People, please .. segregate management interfaces from the Internet. Think about protecting your management interfaces as if your entire network depends on them. Because, in many ways, it does - and which is why you do. not. put. fucking. management. interfaces. on. the. Internet.
Post Scriptum: If you want a resource that conveys the same message as this post, albeit in a much more board-friendly way, look at this post by the National Cyber Security Centre of the United Kingdom.