Fortinet Confirms Zero-Day Vulnerability Exploited in One Attack

Fortinet has confirmed that the critical vulnerability whose existence came to light last week is a zero-day flaw that has been exploited in at least one attack.

The company privately informed some customers last week about the availability of patches and workarounds for an authentication bypass vulnerability exposing FortiOS and FortiProxy products to remote attacks.

The flaw, tracked as CVE-2022-40684, can allow a remote, unauthenticated attacker to perform unauthorized operations on the targeted appliance’s admin interface using specially crafted HTTP or HTTPS requests.

Fortinet on Monday made public an advisory for CVE-2022-40684 and warned that it’s aware of one attack involving exploitation of the zero-day. The company has provided an indicator of compromise (IoC) that customers can use to check if their appliances have been hacked.

It’s likely that exploitation of the vulnerability occurred before Fortinet released a patch. Limited exploitation of a security flaw typically suggests that a sophisticated threat actor — likely a state-sponsored group — is behind the attacks.

However, details and proof-of-concept (PoC) exploits are expected to become publicly available in the coming days, which will allow other threat actors to add the exploit to their toolset.

Researcher Carlos Vieira said the vulnerability is “really simple to exploit and easy to weaponize” and warned that exploitation can lead to a full device takeover.

SANS Institute reported seeing an increase in scans for an old Fortigate vulnerability and the company believes someone may be trying to create a list of potential targets for CVE-2022-40684 exploitation.

According to Fortinet’s advisory, in addition to FortiProxy web gateways and security appliances running FortiOS, the flaw impacts FortiSwitch Manager, the management platform for FortiSwitch switches. Versions 7.0.x and 7.2 are affected and patches are included in versions 7.0.7, 7.2.1 and 7.2.2.

There are many vulnerable devices that are exposed to the internet, which makes widespread exploitation very likely. It’s not uncommon for threat actors to target Fortinet devices in their attacks.

Related: Vulnerabilities in Fortinet WAF Can Expose Corporate Networks to Attacks

Related: Fortinet Patches High-Severity Vulnerabilities in Several Products

Related: Tens of Thousands of Unpatched Fortinet VPNs Hacked via Old Security Flaw