This article is based on a live Nessus vulnerability assessment conducted on a KwaZulu-Natal dental practice in March 2026. All findings are real. The client has been fully anonymised. The practice has since remediated the critical and high-severity findings. This is published with client consent for the purpose of raising awareness in the healthcare sector.
The Device Nobody Thinks About
In almost every small practice I assess, there is a piece of network equipment in a corner or on a shelf that has not been touched since the day it was installed. It hums quietly. It connects everyone to the internet. Nobody logs into it. Nobody patches it. Nobody even knows what version of software it's running — because why would they? It just works.
That device is usually the most dangerous thing on the network.
In this engagement — a full internal network vulnerability assessment of a KZN dental practice — the most severe finding wasn't a rogue application or a compromised workstation. It was the router. A TP-Link access point that had been doing its job faithfully, and invisibly, for years. When we ran the Nessus scan, it reported back a single line that stopped everything:
The router was running SSH software released in 2012. The vulnerability allowing unauthenticated remote code execution as root was disclosed in 2016. It was 2026 when we found it. That is a decade of exposure, sitting on the network edge of a practice holding thousands of patient records.
What CVSS 9.8 Actually Means
CVSS — the Common Vulnerability Scoring System — rates vulnerabilities on a scale from 0 to 10. A score of 9.8 sits just below the maximum possible. To understand what that means in practice, look at the vector string:
Breaking that down: this vulnerability can be exploited from the internet, with no prior authentication, with low technical complexity, and results in full compromise of the device — confidentiality, integrity, and availability, all rated High. The attacker needs nothing except internet access and knowledge of the vulnerability. Both are free.
The specific flaw (CVE-2016-7406) is a format string vulnerability in the way Dropbear SSH handles usernames. By sending a crafted login attempt with format string specifiers in the username field, an unauthenticated attacker can execute arbitrary code — and because SSH on this router runs as root, that code executes with full root-level privileges. The fix has been available since 2016. The router just never got it.
The router sits at the perimeter of the entire practice network. Every device in the building routes its traffic through it. Its SSH management interface was enabled and running Dropbear version 2012.55 — a version that predates the security patch by four years. Any internet-connected attacker who scanned for SSH on this IP address would immediately receive a banner advertisement of its vulnerable version. Shodan indexes devices like this automatically. It is not necessary to actively hunt for them.
With root access to the router, an attacker can: intercept and inspect all network traffic passing through the device (including unencrypted internal communications), reroute traffic to attacker-controlled infrastructure, install persistent backdoors that survive router reboots, map the entire internal network, and pivot to attack every device behind the router from a trusted internal position. The router is not just a vulnerable endpoint — it is the keys to every other device on the network.
The same router also carried a second vulnerability: CVE-2016-6255, an arbitrary file write flaw in the libupnp library. An unauthenticated attacker could send a crafted HTTP POST request to write arbitrary files to the router's filesystem. The CVSS score on this one was 7.5. On the same device. Running simultaneously. Two independent paths to full compromise of the network edge.
The Router Was Not the Only Problem
Eleven devices were scanned. The router was the most immediately alarming single finding, but the pattern it revealed — equipment running old software, never updated, never checked — repeated itself across the network.
While the router was the single most dangerous finding, this server came back with three critical vulnerabilities and seven high-severity vulnerabilities — the highest combined count of any host on the network. It was running PHP 7.3.9, a version that has not received security patches since December 2021. The Nessus scan identified multiple independent paths to unauthenticated remote code execution, including a heap-based buffer overflow in phar_extract_file() (CVE-2020-7061, CVSS 9.1) and a remote code execution vulnerability via a malformed fastcgi_split_path_info directive (CVE-2019-11043, CVSS 9.8). An outdated jQuery library added cross-site scripting exposure on top.
Like the router, this server had not been patched or updated since it was deployed. It was simply running — doing whatever it was set up to do — while accumulating years of publicly known, publicly exploitable vulnerabilities.
Across the Windows workstations, three findings combined to create a clear lateral movement path. SMB signing was not required, opening the door to NTLM relay attacks — an attacker who has already gained a network foothold can intercept authentication traffic and relay it to other hosts without ever cracking a password. Unquoted service paths on multiple hosts provide a privilege escalation vector once an attacker has local access. User account passwords were set to never expire, meaning credentials that were compromised last year — or five years ago — are still valid today.
DNS was configured to allow unrestricted zone transfers (AXFR). Anyone who asked the DNS server for a complete list of internal hostnames received one, with no authentication required. This is reconnaissance as a service — the internal network map handed directly to an attacker doing pre-exploitation information gathering.
The POPIA Exposure
A dental practice holds some of the most sensitive personal information in the South African healthcare system. Patient records contain names, ID numbers, contact details, medical histories, medication information, chronic conditions, and treatment records. Under POPIA, this is special personal information — the category afforded the highest level of protection under the Act, covered specifically by Section 26.
The CVSS 9.8 router vulnerability means that any attacker with internet access had a credible, low-effort, unauthenticated path to the network edge — and from there, via the DNS zone transfer, a complete internal map. Via the unpatched PHP server, a direct path to the web-facing infrastructure. Via the disabled SMB signing and non-expiring passwords, a lateral movement path across Windows workstations. None of these attack paths required chaining zero-days. Every single one was documented, patched, and publicly known for years.
Under Section 19 of POPIA, a responsible party must take "appropriate, reasonable, technical and organisational measures" to secure personal information against unauthorised access. A router running a CVSS 9.8 vulnerability disclosed in 2016, unpatched for a decade, on a network holding thousands of patient records — that is a difficult posture to characterise as appropriate or reasonable.
If these vulnerabilities had been exploited and patient data accessed, Section 22 would have required notification to the Information Regulator and to every affected data subject — potentially thousands of individuals. The IBM Cost of a Data Breach Report 2025 puts the average South African breach cost at R44.1 million. Section 107 provides for fines up to R10 million and imprisonment for responsible parties who fail to comply with the Act. The router firmware update was free. The difference between those two outcomes was a firmware update.
What Was Done — and What You Should Do
The client received a prioritised remediation plan on the day findings were reported. Critical items were addressed within two weeks. Here is what was done, and what every practice with similar infrastructure should check immediately.
The Quiet Hum in the Corner
Somewhere in your practice, right now, there is a device that nobody thinks about. It hums. It does its job. No one has logged into it in years. Maybe it's the router. Maybe it's a network switch, a NAS drive, a print server. Maybe it's the PC running the X-ray software that the vendor said "just leave it on Windows 7 for compatibility." Maybe it's a camera system with a web interface that ships with a default password that has never been changed.
The practice in this case study was not negligent. They were not reckless. They had IT support. They had a working network. They had backups. They just had never had anyone look at what was actually on that network, and what state it was in — because why would they? It just worked.
A vulnerability assessment is not an accusation. It is a flashlight. It shows you what is in the corners so you can deal with it before someone else finds it first — someone with less constructive intentions.
In this engagement, the client found out before a breach. The findings were reported, the critical items were remediated within two weeks, and a patch management cycle was put in place. They now have a documented security baseline and a repeatable annual assessment schedule. That is what the process looks like when it works.
Book a Dental Practice Vulnerability Assessment
We assess dental and healthcare practices specifically — network infrastructure, patch status, configuration weaknesses, and POPIA alignment. Conducted by a dentist who understands your clinical environment. You get a written findings report and a prioritised remediation plan. Conducted under strict NDA.
Practicing dentist and independent cybersecurity practitioner based in Umhlanga, South Africa. Founder of Greyhat4Hire. Specialises in penetration testing and vulnerability assessments of healthcare and dental practices — with the unique advantage of understanding the clinical environment from the inside.
About Dr Sykes →