🔴 CRITICAL — Fix Immediately
1. Windows Administrative Shares Exposed (C$, D$, F$, G$)
Risk: Anyone on your WiFi with admin credentials can access your ENTIRE filesystem. This is how ransomware spreads across networks. Default Windows administrative shares give full drive access.
Port: 445 (SMB) — listening on all interfaces
Affected: Solid Circle PC (192.168.254.30)
FIX: Run PowerShell as Admin → Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force then disable admin shares: reg add HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v AutoShareWks /t REG_DWORD /d 0 /f → Reboot. Also disable SMB entirely if you don't use Windows file sharing.
2. AnyDesk Remote Access Running on 2 Ports
Risk: AnyDesk is running as a service with ports 6666 and 7070 open. If password is weak or 2FA is off, anyone on the internet can access this PC. Remote access tools are the #1 entry point for ransomware gangs.
Ports: 6666, 7070
Affected: Solid Circle PC (192.168.254.30)
FIX: Open AnyDesk → Settings → Security → Enable Two-Factor Authentication. Set unattended access password to 16+ characters. Or disable service: sc stop AnyDesk and set to manual start when not needed.
3. RPC Port Exposed (135)
Risk: Windows RPC port 135 is exposed on all interfaces. This enables remote procedure calls — a classic attack vector for lateral movement and privilege escalation.
Port: 135 — listening on 0.0.0.0 and [::]
Affected: Solid Circle PC (192.168.254.30)
FIX: Windows Firewall → Inbound Rules → disable any rules allowing port 135 from "Any" or "Local subnet". Set to "Block" for Public/Private profiles unless absolutely needed.
🟡 WARNINGS — Address Soon
4. Two Linux Devices with SSH Open (.95, .96)
Risk: 192.168.254.95 and .96 are running Ubuntu with OpenSSH 9.6. These were previously identified as ESP32 IoT devices — they are actually Linux servers (likely Raspberry Pis). SSH on default port 22 is exposed. If password auth is enabled (not key-only), they are brute-force vulnerable.
Banner: SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.18
Affected: .95, .96
FIX: On each device — (1) disable password auth: sudo sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config, (2) enable key-only auth, (3) install fail2ban, (4) move SSH to non-standard port (e.g., 2222).
5. Router Port 9000 Exposed — Likely Reolink Forwarding
Risk: Port 9000 is open on the router gateway. This matches the default port for Reolink camera/NVR management. If port-forwarded to the internet, your surveillance cameras are accessible remotely. Unsecured camera feeds are a privacy breach and recon tool for attackers.
Affected: Router (192.168.254.1)
FIX: Log into router admin → Port Forwarding → verify port 9000 target. If Reolink NVR, ensure it has strong credentials (NOT default admin/blank). Better: use WireGuard VPN to access cameras remotely instead of port forwarding.
6. ASUS Armoury Crate (Gigabyte Bloatware) on Ports 9012-9013
Risk: Motherboard utility software with network listeners. These are rarely updated, often have CVEs, and add unnecessary attack surface. ArmourySocketServer.exe has a history of privilege escalation vulnerabilities.
Ports: 9012, 9013
FIX: Uninstall Armoury Crate and Gigabyte App Center. Use BIOS for fan control, MSI Afterburner for GPU monitoring. The fewer background services, the smaller the attack surface.
7. 46 Externally Listening Ports on Solid Circle PC
Risk: 46 ports listening on 0.0.0.0 means 46 potential entry points. Every listening service is an attack vector. Development servers (8000, 8080, 8081, 5173, 8765) are expected but should be firewalled to localhost or LAN-only.
Services: Python HTTP, Vite dev, AnyDesk, SMB, RPC, Edge streaming, motherboard bloatware
FIX: Bind dev servers to 127.0.0.1 instead of 0.0.0.0 unless you need LAN access. Remove unused services. Use Windows Firewall to block inbound on development ports when not actively developing.
🟢 PASSED — Good Security Posture
✅ Windows Defender Active
Antivirus, real-time protection, and IOAV all enabled.
✅ Windows Firewall ON — BlockInbound Policy
Default inbound policy is block. Only excepted services get through.
✅ RDP (Remote Desktop) Closed
Port 3389 is not listening. Major ransomware vector blocked.
✅ WiFi WPA2-Personal with CCMP (AES)
802.11ax (WiFi 6) with strong encryption. WPS status unknown — verify turned off.
✅ UPnP Disabled
Port 1900 closed. UPnP is a major IoT exploitation vector.
✅ Router Admin Ports Not Exposed
Router management interfaces (80, 443, 8080, 8443) all closed. Good.