Fortinet waarschuwt klanten voor ernstig rce lek in FortiGate-firewalls

Fortinet warns customers of serious rce leak in FortiGate firewalls

October 10, 2022

Fortinet is warning customers about a serious vulnerability in a number of FortiGate firewalls and FortiProxy Web proxies. The company has released a patch for the bug, which allows attackers to log into an admin account from a remote location.

The bug is tracked as CVE-2022-40684, although no public information has yet been registered on it. Fortinet is aware of the bug and writes on his site that it has released a patch for this, but the company itself does not provide public details about it. The patch was implemented in FortiOS 7.2.2. Also in the official release notes is called the bug with no information.

The hacker known as Gitworm says Fortinet recommends its customers update FortiOS. The vulnerability is in all FortiOS versions from 7.0.0 to 7.0.6 and from 7.2.0 to 7.2.1. FortiProxy, a Web proxy tool, is also vulnerable. These include versions 7.0.0 to 7.0.6 and version 7.2.0.

The bug has received a Critical rating, and a CVSS score of 9.6. It involves an authentication bypass for the administrator environment. Attackers can access that environment from a distance without authentication. “Because of the ability to execute this exploit from a distance, Fortinet recommends that all customers with the vulnerable versions upgrade them immediately,” the company writes. Attackers can enter a system by making ‘a specially crafted http or https request. By doing so, they can create a argument injection perform. That is a vulnerability tracked as CW-88. As far as we know, the bug is not being exploited publicly and no proof of concept from.

We have since secured the clients our, should we be able to help your organization with keeping your environment safe, or with patching this bug? Please take a moment contact with us.

Recent blogs

Blog

Apple Business: Easier device management… but…

Managing laptops, smartphones, and tablets within your organization is becoming increasingly complex. Especially as employees work hybrid and you want to maintain control over security, updates, and usage. Apple is responding to this with Apple Business: a new platform designed to simplify device management. But the real question is: does this completely solve your challenges? The problem: growing number of devices, less oversight. Many SMEs recognize this: New employees receive devices that need to be set up manually. Apps and settings differ per user. Security is difficult to keep consistent. IT spends a lot of time on management and support. This leads to frustration,…

Blog

Apple 50 Years: 50 Years of Daring to Think Differently

This year, Apple celebrates its 50th anniversary. A milestone that cannot simply be overlooked. Because whether you are a fan or not: Apple has permanently changed the way we work, communicate, and create. At Analyst ICT, we are proud to be part of this ecosystem. As an Apple Technical Partner, we work daily with technology that is not only powerful but, above all, logical and pleasant to use. A different perspective on technology Apple has always distinguished itself by one simple conviction: technology should help people, not hinder them. No unnecessary complexity, but simplicity and ease of use. That aligns seamlessly...

Blog

Why saving passwords in your browser is not a good idea

The blog post below was created in response to a question during our engineering meeting. Every two weeks, we get together with all of our technical staff to discuss the latest developments in technology or with clients. Good client questions also arise during these meetings, such as this one. Time to do some research. Thank you, Wiebe! You've probably experienced this: you log in to a website, and your browser asks if it should remember your password. Convenient, fast, and you don't have to remember anything. However, there's a risk involved. In practice, we see that many security incidents start with something small. Like saving passwords…

Fortinet warns customers of serious rce leak in FortiGate firewalls

Recent blogs

Apple Business: Easier device management… but…

Apple 50 Years: 50 Years of Daring to Think Differently

Why saving passwords in your browser is not a good idea

A newsletter

Superlogic right?

Contact

Direct to

About us

What we do