Plan ahead Medium Check your exposure
Reported remote code execution flaw in FortiClient with FortiPAM
CyberSecurityNews (via Google News)Fortinet, FortiClient, FortiPAM
What happened. CyberSecurityNews reports a critical flaw it calls Fortinet2Shell. It allows remote code execution (running an attacker's commands) in FortiClient when FortiPAM is enabled. The report excerpt gives no versions, fix or exploitation details.
Who is affected. Users of Fortinet FortiClient with FortiPAM enabled. Sites that use these tools for privileged remote access to plant systems may be exposed.
What to do. Check whether you run FortiClient with FortiPAM enabled, and look for the Fortinet advisory for fixed versions.
When to act. Plan ahead: Early reports: sites using FortiClient or FortiPAM for remote access: review exposure before the next maintenance…
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: FortiClient and FortiPAM manage remote and privileged access, which usually sits in the industrial DMZ (L3.5) with endpoints on enterprise IT (L4).
- Are you exposed?
Check endpoints and servers for FortiClient installs with FortiPAM enabled, and note which of them can reach plant systems.
- If you cannot fix it yet
- Limit who can connect through FortiPAM and require multi-factor authentication on that path.
- Keep privileged-access systems off the plant network until a fix is applied.
- Restrict FortiClient endpoints from reaching OT systems directly.
- Watch for
- Watch FortiPAM and FortiClient logs for unexpected sessions or logons to plant systems.
- Look for unusual processes started by FortiClient on endpoints that reach OT.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CyberSecurityNews (via Google News) (opens news.google.com)
More on Fortinet