Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Fortinet Says Recently Patched Vulnerability Exploited to Hack Governments

Fortinet reported that a recently patched vulnerability tracked as CVE-2022-42475 has been exploited in highly targeted attacks aimed at government organizations.

Fortinet reported this week that a recently patched vulnerability tracked as CVE-2022-42475 has been exploited in highly targeted attacks aimed at government organizations.

The security hole impacts the FortiOS SSL-VPN and it can allow a remote, unauthenticated hacker to execute arbitrary code or commands using specially crafted requests.

The vulnerability’s existence was disclosed on December 12, 2022, when Fortinet warned that it was aware of in-the-wild exploitation. The company at the time announced patches and shared indicators of compromise (IoCs).

In a blog post published this week, Fortinet’s Product Security Incident Response Team (PSIRT) shared additional details, including on the malware sample delivered in the observed attacks, as well as the related network traffic.

“The complexity of the exploit suggests an advanced actor and that it is highly targeted at governmental or government-related targets,” the cybersecurity firm said.

When the existence of CVE-2022-42475 came to light, researcher Kevin Beaumont said that it appeared to have been exploited by a ransomware group, but after additional information emerged, the expert said it may have actually been a state-sponsored threat actor disguising its activities as a ransomware operation.

According to new information shared by Fortinet, the hackers delivered a variant of a generic Linux malware customized for targeting its FortiOS operating system.

While some of the payloads could not be recovered, the company’s analysis indicated that the attackers were trying to execute commands, download additional malicious components to compromised systems, and manipulate FortiOS logging functionality.

Regarding the logs, the malware deployed in the attack attempted to patch the FortiOS logging process in an effort to alter logs and evade detection. The malware is also capable of killing the logging process.

This detailed analysis has allowed Fortinet to share additional IoCs.

It’s not uncommon for malicious actors to exploit vulnerabilities in Fortinet products in their attacks, and the vendor admitted in the past that some customers are slow when it comes to patching, even actively exploited vulnerabilities.

According to data from CISA’s Known Exploited Vulnerabilities Catalog, a total of nine Fortinet product vulnerabilities have been exploited in attacks since 2018.

Related: PoC Published for Fortinet Vulnerability as Mass Exploitation Attempts Begin

Related: Cybercriminals Selling Access to Networks Compromised via Recent Fortinet Vulnerability

Related: High-Severity Command Injection Flaws Found in Fortinet’s FortiTester, FortiADC

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

A high-severity format string vulnerability in F5 BIG-IP can be exploited to cause a DoS condition and potentially execute arbitrary code.