ÍâÍøÌìÌÃ

Late Thursday, 6 October 2022, Fortinet disclosed a critical remote authentication bypass vulnerability ¡ªCVE-2022-40684¡ª impacting FortiOS and FortiProxy. The vulnerability could allow a remote unauthenticated threat actor to obtain access to the administrative interface and perform operations via specially crafted HTTP or HTTPS requests.?

?

According to CISA¡¯s Known Exploited Vulnerabilities Catalog, threat actors have historically exploited similar Fortinet vulnerabilities to obtain initial access and move laterally within a victim¡¯s environment. ÍâÍøÌìÌà Wolf assesses threat actors will likely develop a PoC exploit and exploit this vulnerability in the near term based on historical precedence and the privileges obtained via this vulnerability.?

Recommendations for CVE-2022-40684

Recommendation #1: Upgrade FortiOS and FortiProxy?

ÍâÍøÌìÌà Wolf strongly recommends upgrading FortiOS?and FortiProxy to fully remediate CVE-2022-40684. ?

Note: ÍâÍøÌìÌà Wolf recommends following change management best practices for applying upgrades, including testing changes in a dev environment before deploying to production to avoid any operational impact.?

Recommendation #2: Do Not Expose Admin Interfaces Externally?

Following best practices, the administrative interface should not be exposed externally. Limit IP addresses that can reach the administrative interface using a local-in-policy and implement multi-factor authentication (MFA) to make successful exploitation significantly more difficult.?

For more information on this refer to Customer Support Bulletin CSB-221006-1 and the Fortinet user authentication best practices document here: ?

Reference?