Your VPN is being scanned: Pulse and Fortinet
Attackers are scanning for Pulse Secure and Fortinet VPN bugs that leak passwords. The patches have been out for months.
After a talk at Black Hat this month showed how to break several corporate VPNs, attackers started scanning the internet for two of the bugs:
- Pulse Secure (CVE-2019-11510): read any file on the device without logging in, including cached passwords.
- Fortinet FortiGate (CVE-2018-13379): read the file that holds active VPN sessions, with usernames and passwords in plain text.
Both vendors released fixes in the spring. Thousands of devices still aren’t patched.
What to do:
- Patch the VPN today. It’s the front door to your network.
- If it was exposed unpatched, assume passwords leaked: reset them, and check the logs for logins from strange places.
- Require MFA on the VPN, so a stolen password isn’t enough.
Edge devices rarely get the same patching attention as servers. They need more, not less.