I keep trying to make the hashtag #FortiNOT happen. Stop buying their products folks!
From: @GossiTheDog
https://cyberplace.social/@GossiTheDog/113483673211675864
FortiJump Higher details are out. Even with the patch installed, apparently you can get RCE on FortiManager using a FortiGate it manages. https://labs.watchtowr.com/hop-skip-fortijump-fortijumphigher-cve-2024-23113-cve-2024-47575/
Some truly radical opacity from everybody's favorite maker of network security software https://arstechnica.com/security/2024/10/fortinet-stays-mum-on-critical-0-day-reportedly-under-active-exploitation/
Iβm trying hard to make that hashtag happen π
lol at this Watchtowr write up - itβs on the money. Vulns from 1998. Wait until they see the new FortiManager zero day, I wanna see their write up. https://labs.watchtowr.com/fortinet-fortigate-cve-2024-23113-a-super-complex-vulnerability-in-a-super-secure-appliance-in-2024/
No one should be buying Fortinet gear right now. Make it painful enough for them so they have to improve their products #FortiNOT #cybersecurity
From: @simontsui
https://infosec.exchange/@simontsui/111902215196225910
Why you should care about CVE-2024-21762: **Fortinet** vulnerabilities have historically been targeted by Peopleβs Republic of China (PRC) state-sponsored cyber actors. On 19 January 2023, Mandiant [reported](https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw) the exploitation of FortiOS SSL VPN vulnerability [CVE-2022-42475](https://nvd.nist.gov/vuln/detail/CVE-2022-42475) as a zero-day by suspected Chinese threat actors. Mandiant published a [subsequent blog post](https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem) on 16 March 2023 detailing the exploitation of another FortiOS zero-day [CVE-2022-41328](https://nvd.nist.gov/vuln/detail/CVE-2022-41328) by the Chinese threat actor UNC3886. CISA, FBI and NSA assess that PRC state-sponsored cyber actors are seeking to position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States. CISAβs [joint cybersecurity advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a) on 07 February 2024 states that Chinese Advanced Persistent Threat (APT) Volt Typhoon likely obtained initial access by exploiting CVE-2022-42475 in a network perimeter FortiGate 300D firewall that was not patched. Fortinet also provided [case studies](https://www.fortinet.com/blog/psirt-blogs/importance-of-patching-an-analysis-of-the-exploitation-of-n-day-vulnerabilities) of Volt Typhoon targeting of manufacturing, consulting, local government, and internet service provider sectors, and post-exploitation activity described as Living Off the Land (LotL) techniques. #Fortinet #FortiOS #zeroday #activeexploitation #eitw #CVE_2024_21762 #vulnerability #securityadvisory
Brian Clark
Armamix
Newk