I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports
Suppose you're pentesting some small organisation and you found a couple of open UDP ports. Some of them appear to be constantly open. On the first thought, perhaps the ports should be closed, sure.
But I look up the exploits, and it appears that whatever the exploits there are around target everything based on TCP. Furthermore, the networking knowledge suggests that UDP ports are required to be open for basic tasks such as web-browsing...
Am I wrong? Practically, do the UDP ports need to be taken seriously, or is it OK for them to be left open?