Fortinet reiterates call to mitigate against active zero-day, as customers delay fixes

Fortinet has issued an urgent warning to customers advising once again to update devices against a zero-day vulnerability that has been exploited at least once in the wild.

FortiOS, FortiProxy, and FortiSwitchManager are all affected by the zero-day, an authentication bypass flaw which allows threat actors to run operations on a device’s administrative interface. Tracked as CVE-2022-40684, the vulnerability carries a CVSS score of 9.6, and is therefore considered critical.

Before going public with the zero-day on October 10, Fortinet privately contacted the owners of potentially affected devices on October 6, with a list of recommended mitigations. However, the company has said that, at the time of writing, many devices have still not been updated or had mitigations applied, leaving a large number of customers at risk of cyber attacks and opening networks to threats such as malware, ransomware, and data breaches.

FortiProxy OS versions 7.0.0 to 7.2.1 are affected by the flaw, along with FortiProxy versions 7.0.0 to 7.2.0, and FortiSwitchManager 7.0.0 and 7.2.0. In response, the company has released a number of updates, as well as manual workarounds for the three affected services.

“After multiple notifications from Fortinet over the past week, there are still a significant number of devices that require mitigation, and following the publication by an outside party of POC code, there is active exploitation of this vulnerability,” reads Fortinet’s blog post on the update.

“Based on this development, Fortinet again recommends customers and partners take urgent and immediate action as described in the public Advisory.”

The exploit has now been added to the Cybersecurity and Infrastructure Security Agency’s (CISA) ‘known vulnerabilities’ catalogue, which is regularly updated with threats that the agency considers an active threat to federal operations. As a result of being added to the list, federal agencies have until November 1 to patch all Fortinet equipment and apply appropriate mitigations.

“This is a critical vulnerability,” stated Avishai Avivi, CISO at SafeBreach.

“It basically allows the malicious actor to take control of the organisation’s firewall. We join Fortinet in their recommendation. With this being a zero-day vulnerability, we also strongly recommend that organisations take steps to validate their firewall configuration.

"If an attacker manages to take control of the firewall, they can modify the firewall configuration to remove protection, add potential vectors for the attacker to use, and even add users. This is also an important reminder that companies should always keep a backup copy of their firewall configuration files.”