Demo Scan for Spouse: CVE-2022-26809 Write-Up
🎯 Introduction
Recently, I decided to put together a quick live demonstration for my spouse to explain how vulnerability scanning and remediation works in practice. Instead of just talking about “cybersecurity” in abstract terms, I wanted her to see how scanners find risks, how traffic looks on the network, and how a simple defensive control like a firewall can dramatically reduce exposure.
The vulnerability I focused on was CVE-2022-26809, a wormable Remote Procedure Call (RPC) Remote Code Execution vulnerability in Windows. Microsoft rated this as critical, since it allows attackers to potentially send specially crafted network traffic and execute code remotely without user interaction.
🔍 Step 1: Running the Initial Scan
Using OpenVAS/Greenbone, I scanned her Surface laptop while it was connected to our home network with the firewall disabled.
Result:
The scanner flagged TCP port 135 (MSRPC) as exposed.
This port is directly tied to CVE-2022-26809.
Severity: Medium/High depending on scan configuration.
This finding alone was a great teaching point: “See this? This is a door into your system that attackers could try to exploit.”
📡 Step 2: Visualizing Traffic with Wireshark
Next, I fired up Wireshark to capture packets during a targeted scan of port 135.
Filter used:
tcp.port == 135
Command used:
nmap -sV -p 135 <target_IP>
This showed the TCP handshake and MSRPC packets flowing between my scanner and her laptop. I explained:
“These packets right now are harmless — just me asking what’s on the other end. But if an attacker crafted these with exploit code, that’s how a worm could spread from system to system automatically.”
That “invisible made visible” moment really clicked.
🔒 Step 3: Engaging the Firewall
Finally, we turned her Windows firewall back on and rescanned.
Result:
OpenVAS reported no exploitable vulnerabilities (N/A).
Wireshark showed scan attempts being dropped/filtered.
The side-by-side reports clearly demonstrated the difference:
Firewall off: Medium risk, open RPC service.
Firewall on: No exposure, vulnerability effectively mitigated.
🧠 Key Lessons
Vulnerabilities aren’t magic hacks – They require exposure (open ports) to be reachable.
Firewalls matter – A single toggle can mean the difference between “attack surface exposed” and “attack surface gone.”
Visualization helps – Seeing traffic in Wireshark makes it real, not just theory.
Patch + Protect – Even with patches available, layered defense (like firewalls) is still critical.
📌 Closing Thoughts
The demonstration wasn’t about exploiting my spouse’s device — it was about awareness. By showing her the live scan, the flagged CVE, and then the before/after impact of the firewall, she walked away with a much clearer understanding of why cybersecurity matters.
Demo takeaway: Hackers only need one open door. With visibility and proactive defenses, you can keep those doors closed.
Comments