Update: Serial Server Flaws Expose Critical Infrastructure

Rapid7 discovered widespread insecure configurations of internet-exposed serial/terminal servers (primarily Digi devices) that often allow unauthenticated access to connected devices — including POS terminals, ATMs and industrial control systems — with ~114,000 IPs observed and ~13,000 exposed serial ports offering shells; the report documents session-hijacking activity and recommends timeouts, authentication/encryption, firmware updates and enhanced logging.