Fortinet Users See Active Zero-Day Warnings Past and Present

Fortinet firewall users are being warned to patch their devices against active attacks targeting a zero-day vulnerability, as well as review their security following a leak of configuration data pertaining to 15,000 devices.

See Also: On Demand | The Dark Side of AI: Unmasking its Threats and Navigating the Shadows of Cybersecurity in the Digital Age

The zero-day vulnerability is an authentication bypass flaw, tracked as CVE-2024-55591, in multiple versions of FortiOS and FortiProxy that an attacker can exploit “to gain super-admin privileges via crafted requests to Node.js websocket module,” Fortinet said in a Tuesday security alert.

The same day, the U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its catalog of known exploited vulnerabilities “based on evidence of active exploitation.” CISA set a deadline of Jan. 21 for all federal civilian executive branch agencies to either mitigate the flaw or cease using vulnerable instances.

The flaw affects FortiOS versions 7.0.0 through 7.0.16, as well as FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. The vendor has released updates that patch the vulnerability, which rates a 9.6 out of 10 on the CVSS scale, in part because attackers can remotely exploit it, without authentication, to execute arbitrary code on a device.

The vulnerability first came to light publicly on Jan. 10, when security firm Arctic Wolf reported seeing an attack campaign that “involved unauthorized administrative logins on management interfaces of firewalls, creation of new accounts, SSL VPN authentication through those accounts and various other configuration changes,” which it ascribed to a “likely” zero-day vulnerability attackers began using to move laterally through victims’ networks in December 2024.

Cybersecurity firm Rapid7 recommended organizations update affected software immediately and review the indicators of compromise published by Fortinet for signs that they’ve been hacked, which can include new administrative and local accounts having been added.

“Customers should also ensure that firewall management interfaces are not exposed to the public internet and limit IP addresses that can reach administrative interfaces,” Rapid7 said Thursday.

Zero-Day Fallout

Separately, Fortinet customers are being warned to review their infrastructure for signs of fallout pertaining to CVE-2022-40684, a zero-day vulnerability dating back to 2022, following attackers recently leaking configuration data and passwords for more than 15,000 devices to hacking site BreachForums.

The data was leaked by the newly registered BreachForums user “Belsen Group.”

Security researcher Amram Englander has posted a list of all 15,474 leaked IP addresses to help organizations assess their exposure and take necessary remediation steps. Researchers recommend that any organization on the list should treat this as an active incident, review if they patched CVE-2022-40684 before it became public knowledge – or not – and consider rotating credentials and reviewing their infrastructure for signs of compromise.

“The dump is organized by country, with each folder containing IP addresses and configuration data,” said cyber threat intelligence firm KELA. “Some files include usernames, passwords, device management digital certificates and firewall rules,” with all information – including passwords – being listed in plaintext.

“I have been able to verify this dump is real, as devices in it are listed on Shodan and share the same unique serial numbers,” British security research Kevin Beaumont said in a Thursday blog post.

Heise Security researcher Christopher Kunz said he also verified one of the exposed VPN passwords with a victim organization. “They’re definitely legit,” he said.

Any organization whose data leaked “should change administrative and local user passwords immediately,” Rapid7 said. “FortiOS also supports multi-factor authentication for local user accounts, which Rapid7 strongly recommends implementing.”

“Fortinet is aware of a posting by a threat actor who claims to offer compromised configuration and VPN credentials from FortiGate devices,” the vendor said Thursday.

Fortinet said the stolen data appeared to have been amassed in late 2022 by an attacker who targeted CVE-2022-40684 to exploit versions of its FortiOS firmware – 7.0.0 through 7.0.6 and 7.2.0 through 7.2.1 – and steal that configuration information and VPN passwords.

In October 2022, Fortinet first issued confidential mitigation advice to owners of all affected FortiOS, FortiProxy and FortiSwitchManager products, prior to it disclosing the vulnerability publicly. After it did, Fortinet said threat actors immediately began to scan the internet for devices, exploit the vulnerability to download configuration information and also install malicious administrator accounts.

“Fortinet is aware of instances where this vulnerability was exploited to download the config file from the targeted devices and to add a malicious super_admin account called fortigate-tech-support,” the vendor warned at the time.

“Based on our analysis, the data involved is a resharing of data from previous incidents from dates prior to November 2022 and is not related to any recent incident or advisory,” Fortinet said Thursday.

Little is known about Belsen Group. The group’s name may be a reference to the Bergen-Belsen Nazi concentration camp during World War II, where more than 52,000 were killed. The camp first held Soviet prisoners of war and later functioned in part as an “exchange camp” for Jewish prisoners intended for exchange with German prisoners of war interned abroad.

This isn’t the first time hackers have leaked Fortinet-using organizations’ passwords. In November 2020, a researcher warned that attackers leaked approximately 500,000 Fortinet VPN passwords they appeared to obtain by exploiting systems vulnerable to CVE-2018-13379 (see: CISA Warns of Password Leak on Vulnerable Fortinet VPNs).

Old Data, Current Risk

While the latest leak of configuration data might be old, security researchers warned that the risk it poses remains current.

“Many of the devices are still online and reachable,” as well as have configurations and firewall rules identical to what they had two years ago, Beaumont said. Using the IP addresses, he identified Fortinet-using governments, large companies as well as small and midsize organizations using business-leased lines or other telecommunications services among the at-risk customer base.

“The last time somebody did this, it was a ransomware group as basically a freebie to attract operators,” Beaumont said in a post to social network Mastodon.

The leaked dataset may have notable omissions, suggesting that it’s the work of someone based in Russia or who’s friendly to Moscow’s geopolitical interests.

Beaumont found that none of the IP addresses trace to Iran, even though Shodan counts 2,000 devices in the country by virtue of them having an SSL VPN or management interface exposed, while only one Russian IP address shows up, which WHOIS data suggests is located in Crimea, which is a Ukrainian territory occupied by Russia since 2014.