A Cybersecurity Firm Assessed a State's Entire Education System, Finding Thousands of Security Risks

Cyber Security Works, an IT risk management company and partner agency of the U.S. Department of Homeland Security, recently conducted an assessment of an entire state’s public education system, analyzing the security posture across 180 school districts and charter schools.

The investigation included a scan of 1,172 IT infrastructure assets, revealing 2,221 potential IT security problems, including 519 unique vulnerabilities, according to the assessment report by CSW, which does not identify which state requested the assessment.

CSW’s report noted that 17% of the vulnerabilities identified are known to be used by threat actors in cyber attacks against U.S. schools, and 33 of them would “allow hackers to remotely execute malicious code.”

As a result of the report to the state’s education agency, 30 schools immediately remediated the vulnerabilities known to be weaponized by threat actors, improving their security posture, CSW said.

CSW, with offices in Albuquerque and in India, provides risk management, security management, exposure management, and compliance services to public and private organizations in the United States, United Arab Emirates, India, and Asia. The firm is sponsored by and works with DHS’s Cybersecurity and Infrastructure Agency.

In its report — which includes a few key steps it urges school districts to take to reduce the risk of cyberattacks and data breaches — CSW said it found “374 vulnerabilities (that) are weaponized and can be exploited by attackers to gain access to the school systems and steal data.”

“Based on our AI and ML-based predictive analysis, CSW researchers warned that 78 of the existing vulnerabilities are most likely to be exploited by malicious actors and need to be remediated immediately,” the report said.

A List of the Cyber Risk Findings Considered Common Among Schools

A breakdown of the vulnerabilities identified in the assessment is as follows:

  • RCE/PE Vulnerabilities: CSW identified 33 RCE/PE vulnerabilities to be remediated immediately. “If left unchecked, data loss and access loss are imminent.”
  • Ransomware-Associated Vulnerabilities: Three of the districts assessed had “vulnerabilities that have known ransomware exploitation instances:
    • CVE 2019-11043 associated with NextCry ransomware. This ransomware encrypts files on the NextCloud servers. This is a trending PHP CVE which has maximum possibility of exploitation in schools and NAS devices. Our recommendation to schools was to upgrade to PHP version 7.3.11 and to remediate the vulnerability immediately.
    • CVE-2021-34473 associated with Lockfile, BlackByte, and Conti ransomware groups. Our research also shows that the Conti and Lockfile groups are actively being deployed by APT groups like Wizard Spider, Exotic Lily and DEV-0401 to attack prominent organizations.
    • CVE-2018-19943, a command injection vulnerability, and CVE-2018-19949 associated with eCh0raix Ransomware.”
  • Vulnerabilities on CISA’s KEV list: CSW’s report said that 374 of the discovered vulnerabilities are on the CISA-KEVs list of known instances of exploitation.
  • Vulnerability Aging: CSW noted that 22% of the vulnerabilities “could potentially be present in systems since 2001 (based on the vulnerability age), which is extremely dangerous as there are many attack methodologies readily available and refined over the years.” Nearly half, or 45%, of the exploits are less than 6 years old, CSW said.

Four Commonly Missed Exposures K-12 IT Leaders Should Look For

CSW’s assessment report included a list of recommendations for education IT practitioners, commonly overlooked vulnerabilities that can provide an open door to threat actors. In addition to the usual recommendations such as patching and exposures due to misconfigurations, it listed a few education-specific items:

  • Devices exposed to SSH server targeted by FritzFrog P2P Botnet Attack
  • The APT group Sparkling Goblin adopted a new backdoor technique called SideWalk to penetrate cybersecurity defenses of multiple targets, including educational institutions.
  • Exposures in third-party software, including:
    • CVE-2022-1609, a critical vulnerability was observed in School Management Pro, a WordPress plugin with over 3,40,000 customers, exploitation of which could allow complete control of school websites
    • Critical zero-day vulnerabilities were found in Fedena, a now-abandoned software used for school management.
    • “Misconfigured certificates in Eduroam, a free Wi-Fi network used by many universities, exposed the credentials of multiple users.”

Read the full report or learn more about CSW at CyberSecurityWorks.com’s blog.

Featured

  • Abstract AI circuit board pattern

    Nonprofit LawZero to Work Toward Safer, Truthful AI

    Turing Award-winning AI researcher Yoshua Bengio has launched LawZero, a nonprofit aimed at developing AI systems that prioritize safety and truthfulness over autonomy.

  • abstract pattern of cybersecurity, ai and cloud imagery

    Report Identifies Malicious Use of AI in Cloud-Based Cyber Threats

    A recent report from OpenAI identifies the misuse of artificial intelligence in cybercrime, social engineering, and influence operations, particularly those targeting or operating through cloud infrastructure. In "Disrupting Malicious Uses of AI: June 2025," the company outlines how threat actors are weaponizing large language models for malicious ends — and how OpenAI is pushing back.

  • tutor and student working together at a laptop

    You've Paid for Tutoring. Here's How to Make Sure It Works.

    As districts and states nationwide invest in tutoring, it remains one of the best tools in our educational toolkit, yielding positive impacts on student learning at scale. But to maximize return on investment, both financially and academically, we must focus on improving implementation.

  • red brick school building with a large yellow "AI" sign above its main entrance

    New National Academy for AI Instruction to Provide Free AI Training for Educators

    In an effort to "transform how artificial intelligence is taught and integrated into classrooms across the United States," the American Federation of Teachers (AFT), in partnership with Microsoft, OpenAI, Anthropic, and the United Federation of Teachers, is launching the National Academy for AI Instruction, a $23 million initiative that will provide access to free AI training and curriculum for all AFT members, beginning with K-12 educators.