# Devices should not be publicly exposed with remotely exploitable, highly likely to be exploited, high or critical severity CVE's

The query behind this test searches for devices that comply with the following criteria:

Source: https://maester.dev/docs/tests/MT.1087

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/robbevandendaele" title="Robbe Van den Daele · Original author"><img src="https://github.com/RobbeVandenDaele.png" alt="Robbe Van den Daele" width="28" height="28" loading="lazy" decoding="async" /></a><a class="test-byline-avatar" href="/contributors/samerde" title="Sam Erde · Co-contributor"><img src="https://github.com/SamErde.png" alt="Sam Erde" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/robbevandendaele">Robbe Van den Daele</a> with <a href="/contributors/samerde">Sam Erde</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Defender · Exposure Management · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1087
```

## Overview

The query behind this test searches for devices that comply with the following criteria:

- Incoming connections from public IP addresses in last 7 days (internet exposed)
- High or Critical severity CVE's
- CVE's must have known exploits
- CVE's are remotely exploitable over the network
- No user interaction is required to exploit the CVE's
- EPSS score of CVE must be above 10% (likelihood of exploitation)

> NOTE! If devices are placed behind a proxy, they will not be returned in this query by default

Devices that return from these results are possible high-risk devices that could be exploited successfully any time.

### How to fix
Review the devices in the list and either patch the severities, or make sure to implement mitigative controls to reduce exposure. If you want to have more details on the exposed devices and their related CVE's, you can [run the following query manually](https://github.com/HybridBrothers/Hunting-Queries-Detection-Rules/blob/main/Exposure%20Management/HuntPublicRemotelyExploitableDevicesWithHighEPSS.md) in Advanced Hunting.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1087 |
| Severity | High |
| Suite | Maester |
| Product | Defender |
| Feature | Exposure Management |
| Area | Devices and endpoints |
| Resource type | Device |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1190 Exploit Public-Facing Application |
| PowerShell test | [Test-MtXspmPublicRemotelyExploitableHighExposureDevices](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1087.ps1) |
| Services | Graph |
| Long running | Yes |

</details>

## Source

- Test: [`tests/maester/xspm/Test.MT.1087.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1087.ps1)
- Documentation: [`tests/maester/xspm/Test.MT.1087.md`](https://github.com/maester365/maester/blob/main/tests/maester/xspm/Test.MT.1087.md)