Industrial VPN vulnerabilities put critical infrastructure at risk