Even if it’s not directly accessible from the internet on its own, if it’s accessible from an host exposed to the internet then anyone that can compromise a single host can immediately compromise the firewall.
“It’s only exposed to the outdated wordpress server” is effectively the same as being exposed to the internet.
Yeah that’s my point. Even if the manufacturer actually limits the IP config on the mgmt interface to be configured as not routable over the internet, it could intentionally be on a subnet accessible by some kind of ssh jump server or bastion host. (Or in your example, maybe unintentionally via the Wordpress server.)
Even if it’s not directly accessible from the internet on its own, if it’s accessible from an host exposed to the internet then anyone that can compromise a single host can immediately compromise the firewall.
“It’s only exposed to the outdated wordpress server” is effectively the same as being exposed to the internet.
Yeah that’s my point. Even if the manufacturer actually limits the IP config on the mgmt interface to be configured as not routable over the internet, it could intentionally be on a subnet accessible by some kind of ssh jump server or bastion host. (Or in your example, maybe unintentionally via the Wordpress server.)