For awareness High Patch in your normal cycle CVSS 7.4
Fortinet fixes login bypass flaw in its SSH service
Fortinet PSIRTFortinet, FortiOS, FortiProxy
What happened. Fortinet reports a flaw in the SSH daemon of FortiOS, FortiSASE, FortiProxy and FortiPam. An unauthenticated attacker may bypass authentication using specially crafted credentials. The CVSS score is 7.4.
Who is affected. Users of Fortinet FortiOS, FortiSASE, FortiProxy and FortiPam. Industrial sites using these gateways for remote access are exposed, as vendors and engineers often reach plant systems through them.
What to do. Check whether you run FortiOS, FortiSASE, FortiProxy or FortiPam and apply the fix in the Fortinet advisory. The report names no versions.
When to act. For awareness: Remote-access owners: check whether this SSH service is exposed and schedule the fix.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: FortiOS and FortiProxy act as boundary firewalls and remote-access gateways, which sit in the industrial DMZ (L3.5) or at the internet edge (L5).
- Are you exposed?
Check your inventory for FortiOS, FortiSASE, FortiProxy and FortiPam devices and whether SSH is reachable from untrusted networks.
- If you cannot fix it yet
- Restrict SSH management access to known administrator addresses only.
- Keep the gateway's management interface off the internet and off the plant network until patched.
- Require multi-factor authentication for all remote-access users.
- Watch for
- SSH logons to the gateway from unfamiliar addresses, or successful logons with unusual credentials.
- New administrator accounts or configuration changes on the gateway.
- ATT&CK for ICS
- T0886Remote ServicesT0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.