- Fortinet issues advisory urging users to apply available patch
- Security researchers warn that the flaw is being exploited en masse
- CISA added the bug to its KEV catalog
A zero-day vulnerability in firewalls built by Fortinet is being exploited en masse to breach corporate networks and possibly deploy ransomware, the company has confirmed, with findings backed up by a number of cybersecurity researchers.
The company recently published a security advisory that describes a critically serious vulnerability in FortiGate’s firewalls. Tracked as CVE-2024-55591, this authentication bypass was given a severity rating of 9.8 and said to affect FortiOS versions 7.0.0 to 7.0.16 and FortiProxy versions 7.0.0 to 7.0.19 and 7.2.0 to 7.2. 12.
Malicious actors could abuse the flaw to gain superadmin privileges, it said.
Massive exploitation
In the announcement, Fortinet said the flaw was “exploited in the wild” and used the opportunity to release a patch.
However, cyber security researcher from Arctic Wolf said that the flaw was already being massively exploited while it was a zero-day (before the patch).
speaks to TechCrunchArcticWolf’s lead threat intelligence researcher, Stefan Hostetler, said the company saw a cluster of intrusions affecting Fortinet devices “in the tens of thousands,” but added that it likely “represents only a limited sample compared to the total actual number” of affected endpoints. Unfortunately, no one was able to confirm even an estimated number of victims.
The researchers also could not attribute the attack to any specific threat actor. However, researcher Kevin Beaumont suggested that at least one of the threat actors is a ransomware operator. “They have a copy of an exploit and are using it for initial access and lateral movement handoff,” he commented.
Yesterday, the US Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its catalog of exploited flaws, including this FortiGate flaw, meaning federal agencies have until February 4, 2025 to apply the patch or stop altogether use FortiGate.
