Fortinet waarschuwt klanten voor ernstig rce lek in FortiGate-firewalls

Fortinet warns customers of serious rce leak in FortiGate firewalls

October 10, 2022

Fortinet is warning customers about a serious vulnerability in a number of FortiGate firewalls and FortiProxy Web proxies. The company has released a patch for the bug, which allows attackers to log into an admin account from a remote location.

The bug is tracked as CVE-2022-40684, although no public information has yet been registered on it. Fortinet is aware of the bug and writes on his site that it has released a patch for this, but the company itself does not provide public details about it. The patch was implemented in FortiOS 7.2.2. Also in the official release notes is called the bug with no information.

The hacker known as Gitworm says Fortinet recommends its customers update FortiOS. The vulnerability is in all FortiOS versions from 7.0.0 to 7.0.6 and from 7.2.0 to 7.2.1. FortiProxy, a Web proxy tool, is also vulnerable. These include versions 7.0.0 to 7.0.6 and version 7.2.0.

The bug has received a Critical rating, and a CVSS score of 9.6. It involves an authentication bypass for the administrator environment. Attackers can access that environment from a distance without authentication. “Because of the ability to execute this exploit from a distance, Fortinet recommends that all customers with the vulnerable versions upgrade them immediately,” the company writes. Attackers can enter a system by making ‘a specially crafted http or https request. By doing so, they can create a argument injection perform. That is a vulnerability tracked as CW-88. As far as we know, the bug is not being exploited publicly and no proof of concept from.

We have since secured the clients our, should we be able to help your organization with keeping your environment safe, or with patching this bug? Please take a moment contact with us.

Recent blogs

Blog

What are quantum computers? And why is everyone suddenly talking about them?

Chances are you've been hearing more and more about quantum computers in recent months. In the news, on LinkedIn, or perhaps even during conversations about AI and cybersecurity. Especially now that a Dutch chip developer is gaining global attention with a new generation of quantum chips, the technology suddenly seems closer than ever. But what exactly is a quantum computer? And why is so much expected of it? From Ordinary Computer to Quantum Computer To understand quantum computers, it's helpful to first look at how a normal computer works. A traditional computer — like your laptop or server — works with bits. A…

Blog

With our feet in the mud

Here we are. Not quite recognizable anymore, thanks to AI trying to protect children. Understandable, of course. But believe us: these really are Berry and Frank. More than ten years apart, but in reality, we've always been brothers from another mother. And what do we have in common? A lot... and at the same time, almost nothing. Berry is often the good cop. Calm, down-to-earth, and always working to get things done. I'm usually the bad cop. Direct, critical, and always looking for ways to improve. But that combination is precisely what works. What completely unites us, though, is our love for...

Blog

MacAdmins Meeting: What's relevant for your organization?

Last week, we attended the MacAdmins Meeting in Leiden. It's a gathering focused on Apple administration, security, and innovation. What stood out? Developments are moving fast. But more importantly: they are becoming increasingly relevant for SMEs. We'd like to share the key insights with you. What's happening? And what does that mean for your organization? Running AI Locally: Control Over Data and Costs AI is now everywhere. But one question remains central: where does your data reside? A significant topic during the meeting was running AI models (LLMs) locally. Instead of relying on external cloud platforms, more and more...

Fortinet warns customers of serious rce leak in FortiGate firewalls

Recent blogs

What are quantum computers? And why is everyone suddenly talking about them?

With our feet in the mud

MacAdmins Meeting: What's relevant for your organization?

A newsletter

Superlogic right?

Contact

Direct to

About us

What we do