Zero-Day Vulnerability Suspected in Attacks on Fortinet Firewalls with Exposed Interfaces
What:
Attackers gained unauthorized access to management interfaces of FortiGate firewalls, creating super admin accounts, altering configurations, and setting up SSL VPN access.
Exploitation involved DCSync techniques for credential extraction and lateral movement.
Vulnerability affects FortiOS (versions 7.0.0–7.0.16, 7.2.0–7.2.12) and FortiProxy (versions 7.0.0–7.0.19, 7.2.0–7.2.12).
CVE-2024-55591 has a critical CVSS score of 9.6.
Impact:
Widespread, opportunistic targeting with no specific sector focus.
Attackers used crafted requests via Node.js websocket to gain super-admin privileges.
Victims' networks were compromised, enabling attackers to extract credentials, create accounts, and manipulate firewall policies.
Organizations with exposed firewall management interfaces are at significant risk.
Mitigation:
Upgrade to patched firmware:
FortiOS 7.0.17 or above, 7.2.13 or above.
FortiProxy 7.0.20 or above, 7.2.13 or above.
Restrict public access to firewall management interfaces and limit to trusted users.
Read the full article HERE