Connect with us

Hi, what are you looking for?



Fortinet Says Backdoor in FortiOS Not Malicious

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

A security hole affecting older versions of Fortinet’s FortiOS operating system allows attackers to gain unauthorized access to vulnerable devices, but the vendor says it’s not a malicious backdoor.

FortiOS is a hardened operating system that powers Fortinet’s FortiGate firewall platform. Earlier this week, what appeared to be an exploit for an SSH backdoor in FortiOS 4.x through 5.0.7 was published on the Full Disclosure mailing list. Tests confirmed that the exploit was working.

Fortigate FortiOS backdoorExperts assumed that this could be a backdoor similar to the one found by Juniper Networks in its ScreenOS operating system. In the case of Juniper, the backdoor existed due to unauthorized code introduced by unknown parties.

Fortinet claims the flaw found in its products is not a backdoor vulnerability introduced as a result of malicious activity conducted by internal or external actors. Instead, the company says it’s a management authentication issue identified in 2014 by the company’s product security team as part of their regular testing and review efforts.

According to Fortinet, the security hole could have been exploited for remote console access to vulnerable devices that had the admin access feature enabled for SSH.

The vendor has pointed out that the vulnerability, which it has classified as high risk, was fixed in FortiOS 4.3 with the release of version 4.3.17 on July 9, 2014, and in FortiOS 5.0 with the release of version 5.0.8 on July 28, 2014. The company says later versions, including currently supported 5.2 and 5.4 branches, are not impacted by the flaw. The vulnerability appears to have existed since the release of FortiOS 5.0.0 and 4.3.0.

Fortinet did not release an advisory for this vulnerability at the time when it was patched. In an advisory published on Tuesday, the company provided the following workarounds: disable SSH admin access on all interfaces, or restrict SSH access to authorized IP addresses.

After analyzing the exploit, some experts confirmed that the “backdoor” is likely an internal appliance management mechanism since it only works with the username “Fortimanager_Access.”

Advertisement. Scroll to continue reading.

In the case of Juniper Networks, the company is still investigating the source of the unauthorized code found in its ScreenOS operating system for NetScreen firewalls. The code introduces two vulnerabilities: one that can be exploited for remote admin access and one that can be leveraged to decrypt VPN traffic.

Despite reports that malicious actors have been attempting to exploit the remote access flaw, many Juniper devices remain unpatched.

Following reports that decrypting VPN traffic might have been possible due to the use of the backdoored Dual EC deterministic random bit generator, Juniper announced last week that it will replace the technology with the one currently used in its Junos operating system.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.