Weaknesses
Ranked by whether they sit on an open path. A critical CVE that cannot be chained stays below a misconfiguration that reaches Domain Admin.
| Weakness | Host | Technique | On open paths | State |
|---|---|---|---|---|
| critical | DC-01 | T1003.006DCSync | 1 | Exploitable |
| critical | DC-01 | T1110.004Credential Stuffing | 1 | Exploitable |
| critical | ci.northline.example | T1552.001Credentials In Files | 1 | Exploitable |
| high | ERP-SQL-01 | T1078Valid Accounts | 1 | Exploitable |
| high | FS-PAYROLL | T1039Data from Network Shared Drive | 1 | Exploitable |
| high | ci.northline.example | T1552.005Cloud Instance Metadata API | 1 | Exploitable |
| high | vpn.northline.example | T1190Exploit Public-Facing Application | 1 | Exploitable |
| high | ENG-WS-04 | T1021.002SMB/Windows Admin Shares | 1 | Exploitable |
| high | HMI-CELL-3 | T1078.001Default Accounts | 1 | Exploitable |
| medium | VY-WIN-0142 | T1552.001Credentials In Files | 1 | Exploitable |
| medium | vpn.northline.example | T1133External Remote Services | 1 | Exploitable |
| medium | vendors.northline.example | WEB-BOLABroken object authorization | 1 | Exploitable |
| medium | VY-WIN-0142 | T1566.001Spearphishing Attachment | 0 | Exploitable |