- Fortinet releases advisory urging users to apply available patch
- Security researchers warn the bug is being exploited en-masse
- CISA added the flaw to its KEV catalog
A zero-day vulnerability in firewalls built by Fortinet is being exploited en-masse to breach corporate networks and possibly deploy ransomware, the company has confirmed, with the findings backed up by a number of cybersecurity researchers.
The company recently published a security advisory, detailing a critical-severity vulnerability in the FortiGate firewalls. Tracked as CVE-2024-55591, this authentication bypass was given a severity score of 9.8, and said it affects FortiOS version 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19, and 7.2.0 through 7.2.12.
Malicious actors can abuse the bug to gain super-admin privileges, it was said.
Massive exploitation
In the advisory, Fortinet said the bug was “being exploited in the wild”, and used the opportunity to release a patch.
However, cybersecurity researcher from Arctic Wolf said the bug was already being massively exploited while it was a zero-day (before the patch).
Speaking to TechCrunch, ArcticWolf’s lead threat intelligence researcher Stefan Hostetler said that the company saw a cluster of intrusions that affected Fortinet devices “in the tens”, but added that it likely “only represents a limited sample compared to the total actual number” of affected endpoints. Unfortunately, no one was able to confirm even an estimated number of victims.
The researchers also could not attribute the attack to any particular threat actor. However, researcher Kevin Beaumont suggested that at least one of the threat actors is a ransomware operator. “They have a copy of an exploit and are using it for initial access and handing off for lateral movement,” he commented.
Yesterday, the US Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its catalog of exploited flaws, including this FortiGate bug, meaning federal agencies have until February 4, 2025 to apply the patch or stop using FortiGate entirely.
Leave a comment