A newly reported zero-day vulnerability in FortiOS SSL VPN has been identified as a possible risk for users. The vulnerability, which is tracked as CVE-2018-13379, was discovered by researchers from Positive Technologies and is rated as “High” severity. Attackers could exploit the vulnerability to gain access to a target system.
Fortinet, the company behind the FortiOS VPN, was notified of the vulnerability in April 2018 and stated that it was fixed in July of 2018 with the FortiOS 5.6.2 patch. All customers using FortiOS 5.6.2 and above should be safe in regards to this vulnerability.
The SSL VPN vulnerability allows an attacker to gain access to a target system without authentication. This is done by exploiting a flaw in the SSL VPN authentication process that lets an attacker bypass authentication and gain access to the system.
The attacker can then access credentials, use the system for malicious activities or even gain access to critical information. It is advised that users of FortiOS SSL VPN update their systems with the latest patch to gain protection from this vulnerability.
Although this specific vulnerability has not been used in any attacks yet, it is always important to stay up to date with the latest security updates to protect against malicious activities. Fortinet has provided a detailed security advisory on the issue, including mitigation instructions and other information. If you’re using FortiOS SSL VPN, be sure to update your systems as soon as possible.
This Cyber News was published on securityaffairs.com. Publication date: Mon, 23 Jan 2023 08:46:03 +0000