IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Fortinet reiterates call to mitigate against active zero-day, as customers delay fixes

A large number of customers have yet to apply mitigations necessary to avoid the critical vulnerability

The Fortinet logo on a phone, with blue binary code in the background

Fortinet has issued an urgent warning to customers advising once again to update devices against a zero-day vulnerability that has been exploited at least once in the wild.

FortiOS, FortiProxy, and FortiSwitchManager are all affected by the zero-day, an authentication bypass flaw which allows threat actors to run operations on a device’s administrative interface. Tracked as CVE-2022-40684, the vulnerability carries a CVSS score of 9.6, and is therefore considered critical.

Related Resource

Facilitating Fintech

Reducing the risk of potential data interception among fintech solutions

Whitepaper cover with title and purple and yellow circular graphics, including cartoon of man's faceFree Download

Before going public with the zero-day on October 10, Fortinet privately contacted the owners of potentially affected devices on October 6, with a list of recommended mitigations. However, the company has said that, at the time of writing, many devices have still not been updated or had mitigations applied, leaving a large number of customers at risk of cyber attacks and opening networks to threats such as malware, ransomware, and data breaches.

FortiProxy OS versions 7.0.0 to 7.2.1 are affected by the flaw, along with FortiProxy versions 7.0.0 to 7.2.0, and FortiSwitchManager 7.0.0 and 7.2.0. In response, the company has released a number of updates, as well as manual workarounds for the three affected services.

“After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability,” reads Fortinet’s blog post on the update.

“Based on this development, Fortinet again recommends customers and partners take urgent and immediate action as described in the public Advisory.”

The exploit has now been added to the Cybersecurity and Infrastructure Security Agency’s (CISA) ‘known vulnerabilities’ catalogue, which is regularly updated with threats that the agency considers an active threat to federal operations. As a result of being added to the list, federal agencies have until November 1 to patch all Fortinet equipment and apply appropriate mitigations.

“This is a critical vulnerability,” stated Avishai Avivi, CISO at SafeBreach.

“It basically allows the malicious actor to take control of the organisation’s firewall. We join Fortinet in their recommendation. With this being a zero-day vulnerability, we also strongly recommend that organisations take steps to validate their firewall configuration.

"If an attacker manages to take control of the firewall, they can modify the firewall configuration to remove protection, add potential vectors for the attacker to use, and even add users. This is also an important reminder that companies should always keep a backup copy of their firewall configuration files.”

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Recommended

Getting board-level buy-in for security strategy
Whitepaper

Getting board-level buy-in for security strategy

30 Nov 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

28 Nov 2022
2022 IBM's Security X-Force cloud threat landscape report
Whitepaper

2022 IBM's Security X-Force cloud threat landscape report

22 Nov 2022
2022 Magic quadrant for Security Information and Event Management (SIEM)
Whitepaper

2022 Magic quadrant for Security Information and Event Management (SIEM)

22 Nov 2022

Most Popular

Empowering employees to truly work anywhere
Sponsored

Empowering employees to truly work anywhere

22 Nov 2022
Salesforce co-CEO Bret Taylor resigns with cryptic parting message
Business operations

Salesforce co-CEO Bret Taylor resigns with cryptic parting message

1 Dec 2022
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022