Network Vulnerability Assessment Report

Client City of Westbrook, OH

Report Date 2026-06-22

Scope Authorized municipal network assessment, 10.50.0.0/24 (City of Westbrook, OH sample)

Assessor Bullium Consulting LLC

Start Time 06-22-26
09:19:17 AM EDT

End Time 06-22-26
09:19:18 AM EDT

Executive Summary

Domains Scanned

Hosts Discovered

Open Ports

Total Findings

Critical

High

Medium

Low

Info

Bullium Risk Score

100

Risk Score

Risk Assessment

Critical, Severe exposure, immediate action required

Run regular scans to track your risk trend over time.

70/100

Operational Score (Grade D)

2 exception(s) applied, −30 points

Your risk exceeds acceptable thresholds. Bullium Consulting can help you prioritize remediation and reduce your attack surface.

Schedule a Professional Review

Methodology

This assessment was conducted using the Bullium Consulting netvuln-tool v4.1.0, a modular network reconnaissance and vulnerability assessment framework.

Phases Executed:

Tools Used: nmap, dig, whois, openssl, curl, smbclient, snmpwalk

Assessment Workflow:

Discovery, Host detection, DNS enumeration, WHOIS/OSINT
Enumeration, Port scanning, service detection, protocol analysis
Vulnerability Assessment, Automated vulnerability scanning, cross-referencing
Reporting, Findings aggregation, severity classification, report generation

Scoring Reference (Severity Classification, Risk Score, Grade Scale, Remediation Difficulty) ▶

Severity Classification

Each finding is assigned a severity level using a three-tier approach:

CVE/CVSS Lookup, When a CVE identifier is found, the CVSS v3.1/v3.0/v2 base score is retrieved and mapped to severity.
Pattern Matching, Findings without CVEs are classified by keyword patterns (e.g., RCE, default credentials, weak SSL).
Port-Based Default, Remaining findings receive severity based on the service type (e.g., Telnet → High, FTP → Medium).

CVSS Score	Severity	Description
9.0 – 10.0	Critical	Exploitable vulnerabilities with maximum impact
7.0 – 8.9	High	Significant vulnerabilities requiring prompt action
4.0 – 6.9	Medium	Moderate issues that should be addressed
0.1 – 3.9	Low	Minor issues with limited impact
0.0 / N/A	Info	Informational findings, no direct risk

Bullium Risk Score (0–100)

The overall risk score is computed from finding counts weighted by severity, plus bonuses for high-risk exposed services:

Score = (Critical × 25) + (High × 15) + (Medium × 5) + (Low × 1) + Port Bonuses

Component	Points	Examples
Critical finding	25 each	RCE, default credentials, SQL injection
High finding	15 each	Weak SSL/TLS, SMB null sessions, anonymous FTP
Medium finding	5 each	Missing headers, outdated software, weak SSH
Low finding	1 each	Banner disclosure, minor config issues
Cleartext service	+10 each	Telnet (23), FTP (21)
Management port	+8 each	RDP (3389), VNC (5900), MySQL (3306), PostgreSQL (5432), SQL Server (1433), MongoDB (27017), Redis (6379)

The score is capped at 100. A score of 0 indicates no findings or risks detected.

Grade Scale

Grade	Score Range	Rating
A	0 – 20	Excellent, Minimal risk exposure
B	21 – 40	Good, Low risk, minor issues
C	41 – 60	Fair, Moderate risk, action recommended
D	61 – 80	Poor, Significant risk, remediation needed
F	81 – 100	Critical, Severe exposure, immediate action required

Remediation Difficulty

Each remediation item is classified by the level of expertise required to implement the fix:

Difficulty	Definition	Examples
self-service	Can be resolved by your internal team without specialized security expertise	Configuration changes, software updates, header additions
professional	Requires specialized security expertise or vendor engagement to resolve	Architecture redesign, custom security controls, vendor coordination

Risk Trend

When multiple scans of the same target exist, the current score is compared to the most recent prior scan to determine trend direction: Improving (score decreased), Worsening (score increased), or Stable (no change).

Findings

ID ▲	Severity ▲	Host ▲	Port ▲	Finding ▲	Description
F002	critical	10.50.0.10	80	Remote Code Execution via Log4Shell (CVE-2021-44228)	Synthetic finding: Remote Code Execution via Log4Shell (CVE-2021-44228)
F006	critical	10.50.0.11	80	SQL Injection in Login Form	Synthetic finding: SQL Injection in Login Form
F008	high	10.50.0.12	443	Weak SSL/TLS Configuration (TLS 1.0 Enabled)	Synthetic finding: Weak SSL/TLS Configuration (TLS 1.0 Enabled)
F010	high	10.50.0.13	445	SMB Null Session Allowed	Synthetic finding: SMB Null Session Allowed
F013	high	10.50.0.14	21	Anonymous FTP Access Enabled	Synthetic finding: Anonymous FTP Access Enabled
F017	high	10.50.0.15	23	Telnet Service Exposed	Synthetic finding: Telnet Service Exposed
F001	medium	10.50.0.10	80	Outdated Apache HTTP Server (2.4.29)	Synthetic finding: Outdated Apache HTTP Server (2.4.29)
F005	medium	10.50.0.11	443	Self-Signed SSL Certificate	Synthetic finding: Self-Signed SSL Certificate
F007	medium	10.50.0.12	161	SNMP Default Community String	Synthetic finding: SNMP Default Community String
F011	medium	10.50.0.13	53	DNS Zone Transfer Allowed	Synthetic finding: DNS Zone Transfer Allowed
F014	medium	10.50.0.14	443	Expired SSL Certificate	Synthetic finding: Expired SSL Certificate
F016	medium	10.50.0.15	22	Weak SSH Key Exchange Algorithm	Synthetic finding: Weak SSH Key Exchange Algorithm
F019	medium	10.50.0.16	80	Missing HTTP Strict Transport Security Header	Synthetic finding: Missing HTTP Strict Transport Security Header
F020	medium	10.50.0.17	80	Missing Content Security Policy Header	Synthetic finding: Missing Content Security Policy Header
F003	low	10.50.0.10	80	Server Version Banner Disclosed	Synthetic finding: Server Version Banner Disclosed
F004	low	10.50.0.11	0	ICMP Timestamp Response Enabled	Synthetic finding: ICMP Timestamp Response Enabled
F009	low	10.50.0.12	80	Cookie Without Secure Flag	Synthetic finding: Cookie Without Secure Flag
F012	low	10.50.0.13	80	Directory Listing Enabled	Synthetic finding: Directory Listing Enabled
F015	info	10.50.0.14	80	HTTP Methods Enabled (OPTIONS, TRACE)	Synthetic finding: HTTP Methods Enabled (OPTIONS, TRACE)
F018	info	10.50.0.15	53	DNS Server Version Disclosed	Synthetic finding: DNS Server Version Disclosed

Page 1 of 1 (20 findings)

Compliance Framework Mapping

Vulnerability findings mapped to industry compliance frameworks. Gap analysis shows controls without associated findings.

CIS

6 of 20 controls 13 findings

14 controls without findings

NIST

5 of 22 controls 13 findings

17 controls without findings

ORC

4 of 5 controls 13 findings

1 controls without findings

PCI

9 of 12 controls 13 findings

3 controls without findings

SOC

4 of 9 controls 10 findings

5 controls without findings

Framework	Control ID	Control Name	Findings	Status
CIS	16.11	Use Standard Hardening Configurations for Application Infrastructure	F006
CIS	18.3	Remediate Penetration Test Findings	F012
CIS	3.10	Encrypt Sensitive Data in Transit	F005, F008, F013, F014, F017
CIS	4.8	Uninstall or Disable Unnecessary Services	F007, F011, F015
CIS	5.2	Use Unique Passwords	F016
CIS	7.4	Perform Automated Patch Management	F001, F002	Exception
NIST	DE.CM-8	Vulnerability scans performed	F002	Exception
NIST	PR.AC-3	Remote access is managed	F007, F016
NIST	PR.DS-2	Data-in-transit is protected	F005, F008, F011, F013, F014, F017
NIST	PR.IP-1	Configuration baselines	F006, F012, F015
NIST	PR.IP-12	Vulnerability management plan	F001	Exception
ORC	9.64(C)(1)	Identify critical functions and cybersecurity risks	F005, F006, F008, F014, F016
ORC	9.64(C)(2)	Identify potential breach impacts	F011, F012, F013, F017
ORC	9.64(C)(3)	Mechanisms to detect cybersecurity threats and events	F007, F015
ORC	9.64(C)(5)	Post-incident infrastructure repair and recovery	F001, F002	Exception
PCI	1.3.3	Restrict inbound and outbound traffic	F011
PCI	2.2.4	Only necessary services, protocols enabled	F007
PCI	2.2.7	All non-console admin access encrypted	F013, F016, F017
PCI	4.2.1	Strong cryptography for transmission	F005, F008, F014
PCI	6.2.4	Manage software vulnerabilities	F002	Exception
PCI	6.3.3	Install applicable security patches	F001	Exception
PCI	6.5.1	Injection flaws	F006
PCI	6.5.10	Broken authentication and session management	F015
PCI	6.5.6	Information leakage	F012
SOC	CC6.1	Logical access security	F007, F012, F016
SOC	CC6.6	Restrict external access	F011
SOC	CC6.7	Restrict transmission, movement, and removal	F008, F013, F017
SOC	CC7.1	Detect and act on infrastructure changes	F001, F002, F006	Exception

Ohio Revised Code 9.64 Readiness

Scan evidence mapped to the cybersecurity program requirements that ORC 9.64 places on Ohio political subdivisions.

Counties and cities Adopt a cybersecurity program by January 1, 2026

All other political subdivisions Adopt a cybersecurity program by July 1, 2026

Technical Evidence

4 of 5 technical divisions evidenced by scan findings

Division	Requirement	Status	Findings
9.64(C)(1)	Identify critical functions and cybersecurity risks	Evidenced	F005 F006 F008 F014 F016
9.64(C)(2)	Identify potential breach impacts	Evidenced	F011 F012 F013 F017
9.64(C)(3)	Mechanisms to detect cybersecurity threats and events	Evidenced	F007 F015
9.64(C)(4)	Incident analysis, communication, and containment procedures	No findings mapped
9.64(C)(5)	Post-incident infrastructure repair and recovery	Evidenced	F001 F002

Attestation Checklist

These program requirements cannot be observed by a network scan and require confirmation by the subdivision.

Reference	Requirement	Status
9.64(C)(6)	Annual employee cybersecurity training scaled to duties Ohio Cyber Range Institute or state-provided training satisfies this requirement.	Attested
9.64(D)(1)	Incident notification to Ohio Homeland Security (Cyber Integration Center) within 7 days of discovery	Attested
9.64(D)(2)	Incident notification to Auditor of State within 30 days of discovery	Requires attestation
9.64(B)	Ransomware payment authorized only by legislative resolution or ordinance	Requires attestation

This readiness view maps scan evidence to ORC 9.64 requirements. It is not legal advice. Consult counsel and Auditor of State guidance for compliance determinations.

Network Topology

Port	Protocol	State	Service	Version
80	tcp	open	http

Schedule an Appointment

Book a consultation with Bullium Consulting engineers to review your findings and build a remediation plan.

Network Vulnerability Assessment Report

Executive Summary

Bullium Risk Score

Methodology

Severity Classification

Bullium Risk Score (0–100)

Grade Scale

Remediation Difficulty

Risk Trend

Findings

Remediation Playbook

Compliance Framework Mapping

Ohio Revised Code 9.64 Readiness

Technical Evidence

Attestation Checklist

Network Topology

Host Details

10.50.0.10 (www-legacy.westbrook.oh.us)

10.50.0.11 (portal.westbrook.oh.us)

10.50.0.12 (utility-billing.westbrook.local)

10.50.0.13 (dc-01.westbrook.local)

10.50.0.14 (records.westbrook.local)

10.50.0.15 (core-sw-01.westbrook.local)

10.50.0.16 (cad.westbrook.local)

10.50.0.17 (scada-water.westbrook.local)

Schedule an Appointment