Mohamed Sharaf
Menu
Security

Fortinet SSL-VPN bug: patch, then hunt

A pre-login bug in FortiOS SSL-VPN is being exploited. Update, and look for the signs Fortinet published.

· 1 min read

Last week Fortinet confirmed a critical bug in the SSL-VPN of FortiOS (CVE-2022-42475). Anyone who can reach the VPN login page can run code on the firewall, without logging in. It was already being exploited.

A firewall is the one device every connection passes through. Owning it means owning the network.

What to do:

  1. Update FortiOS to a fixed version for your branch, today.
  2. If you can’t, disable SSL-VPN until you can.
  3. Check for the indicators Fortinet published: certain files on the device, crash logs from the SSL-VPN process, and connections to the listed IP addresses.
  4. If anything matches, treat the firewall as compromised: rebuild it from a clean image, and change every password and key it stored.

Before the holidays, make sure someone owns the firewall patches. Edge devices don’t wait for January.

ShareWhatsAppLinkedInXTelegramFacebook