New Wave of Attacks Targeting FortiGate Firewalls
Source SecurityWeek
Description
Hackers bypass the FortiCloud SSO login authentication to create new accounts and change device configurations. The post New Wave of Attacks Targeting FortiGate Firewalls appeared first on SecurityWeek .
Impact
For European organizations, this threat could lead to unauthorized access to network security controls, enabling attackers to manipulate firewall rules, intercept or redirect sensitive data, and potentially disrupt business operations. The compromise of FortiGate firewalls undermines perimeter defenses, increasing the risk of lateral movement within networks and data breaches. Critical sectors such as finance, healthcare, telecommunications, and government agencies that rely on FortiGate for network security are particularly vulnerable. The cloud-based management aspect means that even geographically dispersed organizations could be affected simultaneously. Additionally, the creation of rogue accounts could facilitate long-term persistence and complicate incident detection and response efforts. The medium severity suggests a moderate but tangible risk that requires attention to prevent escalation into more severe impacts.
Defensive guidance
Organizations should immediately audit their FortiCloud SSO configurations and access logs for signs of unauthorized account creation or configuration changes. Implement strict access controls and multi-factor authentication (MFA) for FortiCloud accounts to reduce the risk of credential compromise. Monitor firewall management activities closely using Security Information and Event Management (SIEM) systems to detect anomalies. Segregate management interfaces from general network access where possible and restrict IP addresses allowed to access FortiCloud management portals. Stay informed on Fortinet advisories and apply patches or updates promptly once available. Consider deploying additional network segmentation and endpoint detection to limit the impact of potential firewall compromise. Conduct regular security awareness training focused on cloud management security best practices. Engage with Fortinet support for guidance and incident response assistance if suspicious activity is detected.
Summary
The reported threat involves attackers bypassing the FortiCloud Single Sign-On (SSO) authentication mechanism used to manage FortiGate firewalls remotely. By circumventing this authentication, attackers can create new administrative accounts and modify firewall configurations without legitimate credentials. This attack vector targets the cloud-based management interface, which is integral for centralized control of FortiGate devices. The ability to create new accounts and change configurations compromises the integrity and confidentiality of the firewall management process, potentially allowing attackers to disable security controls, redirect traffic, or establish persistent access. While the affected versions are unspecified and no public exploits have been observed, the medium severity rating reflects the significant risk posed by unauthorized administrative access. The attack does not require user interaction but depends on exploiting weaknesses in the FortiCloud SSO implementation. The lack of patch information suggests that Fortinet may still be investigating or preparing mitigations. Given FortiGate's widespread use in enterprise and critical infrastructure environments, this vulnerability could have broad implications if exploited.