An updated one 'cause you're running a virtual router in a container or VM which gets all the updates your server(s) get.

FreeBSD in my case.

Typical setups probably aren't listening on a public address (or any address for a desktop), so you'd at least need a LAN attacker presumably.