Fortinet warns a critical vulnerability in its systems could let attackers breach company networks

Image credit: Pixabay (Image credit: Pixabay)

Fortinet releases advisory urging users to apply available patch
Security researchers warn the bug is being exploited en-masse
CISA added the flaw to its KEV catalog

A zero-day vulnerability in firewalls built by Fortinet is being exploited en-masse to breach corporate networks and possibly deploy ransomware, the company has confirmed, with the findings backed up by a number of cybersecurity researchers.

The company recently published a security advisory, detailing a critical-severity vulnerability in the FortiGate firewalls. Tracked as CVE-2024-55591, this authentication bypass was given a severity score of 9.8, and said it affects FortiOS version 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19, and 7.2.0 through 7.2.12.

Malicious actors can abuse the bug to gain super-admin privileges, it was said.

Massive exploitation

In the advisory, Fortinet said the bug was “being exploited in the wild”, and used the opportunity to release a patch.

However, cybersecurity researcher from Arctic Wolf said the bug was already being massively exploited while it was a zero-day (before the patch).

Speaking to TechCrunch, ArcticWolf’s lead threat intelligence researcher Stefan Hostetler said that the company saw a cluster of intrusions that affected Fortinet devices “in the tens”, but added that it likely “only represents a limited sample compared to the total actual number” of affected endpoints. Unfortunately, no one was able to confirm even an estimated number of victims.

The researchers also could not attribute the attack to any particular threat actor. However, researcher Kevin Beaumont suggested that at least one of the threat actors is a ransomware operator. “They have a copy of an exploit and are using it for initial access and handing off for lateral movement,” he commented.

Yesterday, the US Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its catalog of exploited flaws, including this FortiGate bug, meaning federal agencies have until February 4, 2025 to apply the patch or stop using FortiGate entirely.

Thousands of FortiGate VPN systems hit by Chinese hackers
Here's a list of the best antivirus tools on offer
These are the best endpoint protection tools right now

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.