The Device You Forgot About: Why the Office Printer, IP Camera, and Smart Thermostat Are Your Least Protected Network Devices

The Device You Forgot About: Why the Office Printer, IP Camera, and Smart Thermostat Are Your Least Protected Network Devices

We have walked a lot of Northeast Ohio buildings over the past decade. Manufacturing floors off I-77, medical suites in Akron, law offices downtown Cleveland, credit unions near Canton, a college campus in Hiram. The walkthrough usually follows the same script. We ask for the network diagram. It shows the firewall, the servers, the workstations, and the internet circuit.

Then we walk the floor and start counting.

The multifunction printer in accounting. Four IP cameras over the loading dock. The door-access reader at the main entrance. VoIP handsets in the conference room. The smart thermostat that keeps the server closet cool. A digital sign in the lobby. A vendor-supplied label printer on the production line.

None of it is on the diagram. Every one of those devices is a small computer with an IP address, an operating system, and a web login. Almost all of them sit on the same flat network as the file share that holds payroll records. That is the gap we want to talk about.

Your printer has more in common with a laptop than with a stapler

It is easy to think of office equipment as furniture. It is not. A modern multifunction printer runs an embedded operating system, hosts a web administration console, speaks half a dozen network protocols, and stores data.

A few facts worth sitting with:

• Printers keep copies. Many multifunction devices cache scanned and printed pages in memory or on an internal hard drive. When equipment is retired or returned off lease, that storage has to be sanitized to a defined standard. NIST's SP 800-88 media sanitization guidelines were written for exactly this reason, and they apply to copiers and printers, not just laptops.
• Cameras are Linux boxes with a lens. IP cameras run firmware, expose a web interface, and often ship with a cloud or mobile app connector. Once attackers are in, they can watch, they can pivot, and they can recruit the device into a botnet.
• Thermostats and door readers live on your Wi-Fi or PoE. They talk to Windows workstations, they talk to the internet, and they are usually installed once by a vendor and never touched again.
• VoIP handsets have web admin pages. Phones expose configuration interfaces, and phone systems carry toll fraud risk when they are misconfigured or exposed.

None of these devices is inherently dangerous. The problem is that nobody owns them.

Why attackers love gear that nobody owns

Attackers do not need a clever new exploit. They need a device with a known weakness that nobody is watching. The classic profile looks like this:

• Default credentials still in place. Vendors ship admin/admin, admin/password, or a printed sticker. Those defaults are cataloged publicly and tried automatically, thousands of times an hour.
• Firmware that has never been updated. The installer set it up in 2019 and it has been running the same firmware since.
• Services left switched on. Telnet, FTP, UPnP, remote web administration from the internet, default SNMP community strings. Feature-rich out of the box, dangerous on a business network.
• Internet-facing by accident. Port forwarding rules set up years ago to let a vendor log in remotely, still open today. Security researchers and attackers scan the whole internet continuously, which is how these devices get found.
• A flat network underneath. Once an attacker has a foothold, this device sits next to everything that matters.

The Mirai botnet is the textbook case. First seen in 2016, Mirai built a massive attack network almost entirely out of IP cameras and DVRs it compromised using default and hardcoded credentials. The botnet's source code was published that October, and the model it created has been copied ever since. Cloudflare's retrospective analysis of Mirai is still worth reading for any business owner who thinks small devices are not targets.

It is not only criminals. The February 2024 joint advisory on Volt Typhoon described state-sponsored actors maintaining persistent access to U.S. critical infrastructure, including through small office and home office routers. Small, unmanaged gear is a launching point, not just a foot in the door.

Even our printers have had their own headline moments. The July 2021 PrintNightmare vulnerability tracked as CVE-2021-34527 allowed remote code execution with system privileges through the Windows print spooler. Print servers and networked printers had to be patched with the same urgency as domain controllers. Many of them were not, because nobody had them on a patch list.

The flat network is the real problem

Here is the question we ask clients: would you put a guest's laptop on the same network segment as your accounting server?

Nobody says yes. Every business we work with understands that guests belong on their own Wi-Fi, walled off from the business network. That instinct is correct.

Now apply the same logic to the camera on the loading dock and the thermostat in the server closet. They are effectively unmanaged guest devices that happen to belong to you. On a flat network, a compromised camera has a line of sight to your file server, your line-of-business application, and every workstation in the building. That is the definition of a short path to trouble.

Manufacturing clients have an extra layer of exposure. Plant floor equipment, HMIs, and industrial controls should never share a network with email and file shares. This is the core idea behind the ISA/IEC 62443 standards and the Purdue model for industrial control system architecture: separate zones, controlled conduits, no free movement between the plant floor and the business network.

Segmentation is not a product. It is a decision about who gets to talk to whom, enforced on a firewall, and it needs an owner. When nobody owns it, it stops being true.

Three practical moves for this quarter

You do not need a rip-and-replace project to close most of this gap. You need three disciplines applied consistently.

1. Segment: put these devices on their own VLAN

Create a dedicated virtual LAN for cameras, printers, thermostats, door readers, digital signs, and other embedded devices. Allow that segment the internet access it genuinely needs (cloud camera apps, firmware update servers, vendor support tunnels you have approved) and deny it access to the server and workstation VLANs. Guests stay where they are: on their own network.

The test of good segmentation is simple. If your camera VLAN disappeared tomorrow, would anything break? If the answer is no, that is correctly sized isolation.

2. Harden: change defaults and disable what you do not use

• Change every default administrator password before the device goes into production, and store it in a password manager rather than on a sticky note in the utility closet.
• Disable Telnet and FTP. Both transmit credentials without encryption.
• Turn off UPnP and unneeded discovery protocols. Researchers have been warning about UPnP exposure for more than a decade, and it is still shipped enabled.
• Turn off remote administration from the internet. If a vendor needs ongoing access, use a VPN or a managed remote-access tool with logging, not an open port forward.
• Apply the principle of least privilege to the device's own accounts, and change credentials immediately when an employee or contractor with access leaves.
• CISA's Secure by Design initiative exists because manufacturers keep shipping these defaults. Until they stop, hardening is your job at installation time.

3. Inventory and patch: know what is on the network and update it on a schedule

You cannot protect what you have not counted. Asset inventory and secure configuration are the foundation of any credible control framework, including the CIS Critical Security Controls list and the configuration management family in NIST SP 800-53.

Practically, that means:

• Build a written inventory: manufacturer, model, firmware version, location, IP address, who installed it, and who supports it.
• Check firmware against the manufacturer's current release on a defined schedule. We recommend at least quarterly for cameras and network gear, and immediately when a critical advisory lands.
• Re-check the inventory after every installation. New gear appears constantly: a new camera for a new bay, a replacement thermostat after a power surge, a phone added for a new hire.
• Retire devices properly. Factory reset, sanitize storage, and remove firewall rules and DNS entries so old gear does not linger as an orphaned entry point.

The short version: a checklist for your team

• [ ] Ask for the network diagram. Then walk the floor and list every device with a power cord and a network connection.
• [ ] Identify which of those devices are not on the diagram, and add them.
• [ ] Confirm no device still uses a manufacturer default password.
• [ ] Confirm Telnet, FTP, UPnP, and internet-facing remote admin are disabled everywhere they are not required.
• [ ] Create a VLAN for embedded and non-business devices. Deny it access to servers and workstations.
• [ ] Record firmware versions and set a patch cadence with dates on the calendar.
• [ ] Confirm monitoring covers these devices, not just servers and laptops.

This is exactly where fragmented IT lets devices fall through the cracks

We have sat in rooms where four vendors shared one network and nobody owned the whole picture. The internet provider owns the circuit. A reseller sold the firewall. The camera installer handles cameras. The copier is under a lease with a service contract. Each contract stops at the edge of its own box.

When a camera gets compromised, the camera vendor says it is a firewall problem. The firewall vendor says the camera should not be on that network. The printer vendor says printers are not their responsibility. Meanwhile the device is still talking to your file server, and the clock is running.

That is the failure mode we built our business to eliminate. Local Network Solutions covers all six critical pillars under one roof and one SLA: WAN connectivity, cybersecurity, network infrastructure, IT infrastructure, UPS backup, and backup and disaster recovery. We are a locally owned Northeast Ohio company, not a franchise, with more than ten years in the region and more than 500 businesses protected. Our cybersecurity team monitors around the clock. Our network infrastructure team designs the segmentation and owns the firewall rules. Our backup team verifies recovery daily.

Device inventory, VLAN design, firmware cadence, and 24/7 monitoring are not separate projects. They are one continuous job, and it needs one team to own it.

Regulated industries, same answer

The industries we serve carry the same requirement with different labels.

• Healthcare: the HIPAA Security Rule requires a risk analysis covering systems that create, receive, maintain, or transmit electronic protected health information, which includes a networked printer scanning intake forms at a clinic front desk. See the HHS Security Rule guidance.
• Financial services: examiners and card brand requirements expect documented segmentation between sensitive systems and everything else. An unmanaged camera VLAN is a finding waiting to happen.
• Manufacturing: customer audits increasingly ask how you separate plant floor networks from business systems.
• Professional services: law firms and accounting practices hold exactly the kind of data attackers resell. A compromised printer is a credible first step, not a nuisance.
• Higher education: campuses run thousands of connected devices across dozens of buildings, which makes inventory and segmentation a governance problem, not just a technical one.

In every case, the answer is the same three moves: segment, harden, and keep firmware current.

Zero gaps means nobody gets to say "not my device"

Attackers do not care which vendor sold you the camera. They care that the camera answers on port 80 with default credentials and can reach your server. Nothing about that equation changes until someone owns the whole network, not just the parts.

That is the work we do, and it starts with a look at what is actually plugged in. We will walk your floors, map what is on the network, and show you where the gaps are before someone else finds them.

Schedule Your Consultation with our team. Call us at (216) 658-6988 or email hello@localnetworksolutions.com. Complete IT infrastructure. Zero gaps. Zero excuses.