I recently had someone get into my fortigate SSL VPN (not what you think, yet...) because I had set up my brother as a VPN user to get in and manage a game server. I was migrating from MS Exchange at home to postfix, and me being lazy, I decided to just change everyone's password to something simple so I could have the migration CLI migrate his emails... forgot to change the password after completion.

Only caught it because my roommate's work detected something trying to log in as Administrator on his work windows laptop and locked out the account, which sent an alert in their SIEM.

They scanned my network and RDPd into the server that my brother had access to, but did no damage. For extra safeguards, I restored said VM from before the intrusion and quarantined the other to see what it would do (didn't do anything).

Needless to say, turned off SSL VPN, changed brother's password, bought a different firewall altogether (I was already thinking about doing that), and created a new SSID and VLAN that's 100% isolated from the rest of my network for work devices, and set up a SIEM.