Was it just a single CVE? That was the entry point, but was their network just wide open after that. Or did the have to procure more CVEs to get by ssh, firewalls, etc?

I think its about time we had the equivalent of the NTSB to review and publish, publicly, what happened and what the failures were. Nobody died but certainly many people will be affected by this for years to come.