VulnCheck Finds 42.5% of Exploited Edge Vulnerabilities Affect End-of-Life Devices

Summary

VulnCheck analyzed 181 network-edge vulnerabilities added to its KEV in 2025: 42.5% affected end-of-life or likely end-of-life devices, and only 23.7% appeared in CISA KEV. The report highlights botnet targeting and support gaps.

Key points

The report examines 181 known-exploited network-edge vulnerabilities added to VulnCheck KEV in 2025, enriched with device support status, vendor details, and threat intelligence.
VulnCheck associated 42.5% of the vulnerabilities with end-of-life or likely end-of-life devices; another 4.4% affected products at end of sale.
Consumer networking equipment accounted for 56% of exploited edge-device vulnerabilities in the report’s analysis.
Thirty-five vulnerabilities (19%) were known to be targeted by botnets; 65% of those botnet-targeted vulnerabilities affected end-of-life or likely end-of-life devices.
Only 43 of the 181 vulnerabilities (23.7%) were included in CISA KEV; five of the 35 botnet-targeted vulnerabilities appeared there.
VulnCheck said it assigned CVEs to 18 vulnerabilities after detecting exploitation evidence through its canaries and Shadowserver honeypots.
The report advises organizations to remove end-of-life devices, expand exploitation intelligence beyond CISA KEV, and assess vendors’ vulnerability disclosure and product support practices.

Article Details

Publisher: VulnCheck
Report Period: 2025 vulnerabilities analyzed in the 2026 report
Scope: 181 known-exploited network-edge-device vulnerabilities added to VulnCheck KEV in 2025; analysis includes device support status, device types, botnet targeting, ransomware associations, and CISA KEV coverage.
Sample Size: 181 vulnerabilities
Key Statistics: 42.5% of the 181 vulnerabilities affected end-of-life or likely end-of-life devices; an additional 4.4% affected end-of-sale devices.
35 of 181 vulnerabilities (19%) were known to be targeted by botnets; 65% of those botnet-targeted vulnerabilities affected end-of-life or likely end-of-life devices.
43 of 181 vulnerabilities (23.7%) were included in CISA KEV.
Seven of the 181 vulnerabilities were associated with ransomware campaigns; all involved enterprise network-edge devices.
VulnCheck assigned CVEs to 18 vulnerabilities after detecting exploitation activity through canaries and Shadowserver honeypots.
Recommendations: Modernize technology and remove end-of-life devices that remain targeted after vendor support ends.
Use sources such as VulnCheck to extend exploitation visibility beyond the U.S. federal ecosystem and CISA KEV.
Evaluate the security posture of vendors whose products are deployed at the network edge.
Confirm that vendors disclose vulnerabilities and exploitation activity and publish clear, current end-of-life information.