• I. Once a laptop leaves the Kestrel office network its outbound rules stop being enforced, because the company gateway is what applies them.
• II. It can block outbound traffic, so malware already on the laptop cannot reach an attacker’s command-and-control server.
• III. Its rules are an ordered access control list, and the first rule that matches a packet decides that packet’s fate.
• IV. It keeps filtering normally on a customer farm network that Kestrel does not own, cannot configure and cannot inspect.

KESTREL AGWORKS — AUTOMATED MILKING CONTROLLERS
Firmware review, 12 March

Vendor advisory KAW-2026-004
  Affects ......... the controller web interface
                    (remote code execution, no login required)
  Fix released .... 6 weeks ago, for firmware line 4.x ONLY
  Exploit code .... public for 2 weeks

Fleet in service, 218 units
  Firmware 4.x  (supported) ............  51   fix available
  Firmware 3.x  (support ended 2023) ... 167   no fix will ship

All 218 units reach the internet daily so farmers can operate
them remotely. The web interface is enabled on every unit, and
the farmer app does not use it — the app connects through the
vendor cloud service instead.

• (A) Apply the vendor’s 4.x fix to the 3.x units, since the advisory names the same web interface on both firmware lines.
• (B) Raise the controller admin password to 16 characters and rotate it every 30 days on all 167 affected units.
• (C) Install signature-based anti-malware on the 167 units and scan daily so an exploit attempt is flagged when it happens.
• (D) Disable the unused web interface on the 167 units, or block inbound traffic to it with a host-based firewall rule.

• (A) Set each laptop’s host-based firewall to deny all outbound traffic on port 21 and log every attempt.
• (B) Install software on a company laptop only from the Kestrel-approved catalogue, and only with the IT lead’s written approval.
• (C) Bring each company laptop back onto the Kestrel network at least once every seven days, without exception.
• (D) Do not use a company laptop for personal browsing or personal email while working on a customer site.

• (A) The laptop’s signature database was out of date on 3 March and had not been refreshed for several months.
• (B) The 3 March scan was a quick scan rather than a full scan, so the malicious file was never examined.
• (C) No signature for that variant existed yet on 3 March, so a current database still had nothing to match the file against.
• (D) Signature scanning can only flag malware after it executes, so a file sitting on disk can never be detected.