The exploit claims to enable unauthenticated remote code execution (RCE) and full configuration access to FortiOS, allowing attackers to seize control of vulnerable devices without needing credentials. The company has also released advisories detailing indicators of compromise (IOCs) and recommended security measures, such as disabling HTTP/HTTPS administrative interfaces or restricting access via local policies. The forum post observed by ThreatMon boasts extensive capabilities, including access to sensitive configuration files extracted from compromised devices. The exploit appears to target versions of FortiOS vulnerable to authentication bypass flaws, a recurring issue in Fortinet’s products. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. A threat actor has reportedly advertised a zero-day exploit targeting Fortinet’s FortiGate firewalls on a prominent dark web forum. This alarming development raises significant concerns about the security of Fortinet firewalls, widely used in enterprises and government agencies globally. Such data could allow attackers to bypass security measures, infiltrate networks, and potentially launch further attacks. Unauthorized Access: Attackers could gain administrative control over devices, modify configurations, and extract sensitive data. For example, earlier this year, the Belsen Group, a newly identified hacking entity, leaked configuration files for over 15,000 FortiGate firewalls. This latest zero-day exploit underscores the evolving sophistication of cyber threats and the critical need for robust cybersecurity practices across all sectors. More recently, Fortinet disclosed another critical vulnerability (CVE-2024-55591), enabling attackers to gain super-admin privileges through crafted requests. Despite being exploited two years ago, the leaked data remained relevant due to static firewall configurations. This flaw impacted FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12. These incidents highlight a troubling pattern of exploitation targeting Fortinet’s products. Data Breaches: Leaked credentials and configuration files could lead to exposure to confidential information. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Operational Disruption: Altered firewall policies may disrupt normal network operations or create vulnerabilities for future attacks.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 14 Apr 2025 02:40:10 +0000