Plan ahead High Patch available
Fortinet flaws let attackers run code on FortiManager and FortiAnalyzer
CyberSecurityNews (via Google News)Fortinet
What happened. CyberSecurityNews reports critical flaws in Fortinet FortiManager and FortiAnalyzer that allow remote code execution without a login. A second report covers the same flaws.
Who is affected. Users of Fortinet FortiManager and FortiAnalyzer. Industrial sites that manage boundary firewalls with them may be exposed, as vendors and engineers often reach plant systems through those firewalls.
What to do. Check whether you run Fortinet FortiManager or FortiAnalyzer and apply the vendor patch as soon as it is available.
When to act. Plan ahead: Early reports: unauthenticated flaws in Fortinet management tools; check firewall management access.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: FortiManager and FortiAnalyzer manage boundary firewalls, which sit in the industrial DMZ (L3.5) and the enterprise network (L4).
- Are you exposed?
Search your asset inventory for FortiManager and FortiAnalyzer, and check whether their management interfaces are reachable from untrusted networks.
- If you cannot fix it yet
- Restrict management access to FortiManager and FortiAnalyzer to a small set of known administration hosts.
- Keep these management interfaces off the internet and off the plant network until patched.
- Watch for
- Unexpected logins or connections to FortiManager and FortiAnalyzer management interfaces from unknown addresses.
- Unplanned configuration changes pushed from FortiManager to managed firewalls.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CyberSecurityNews (via Google News) (opens news.google.com)
More on Fortinet