Hackers Exploit New Vulnerability in Fortinet Firewalls to Breach Networks

Security researchers have identified that malicious actors are actively exploiting a newly discovered vulnerability in Fortinet's FortiGate firewalls, compromising corporate and enterprise networks.

Fortinet issued an advisory confirming that the critical vulnerability, tracked as CVE-2024-55591, is "being exploited in the wild." Patches have been released, but it has been reported that hackers have been using the vulnerability as a zero-day since December, before Fortinet became aware and provided fixes.

Widespread Impact and Comparisons

This incident highlights another significant exploitation of vulnerabilities in enterprise security products designed to safeguard networks from cyber threats. This follows close on the heels of another security issue in Ivanti VPN servers that similarly jeopardized network integrity.

Cybersecurity firm Arctic Wolf reported a "mass exploitation" targeting Fortinet FortiGate devices with management interfaces exposed to the internet. Stefan Hostetler, lead threat intelligence researcher at Arctic Wolf, confirmed that this is linked to CVE-2024-55591.

Hostetler stated that Arctic Wolf has observed "a cluster of intrusions" affecting "tens" of devices, but cautioned that this represents only a "limited sample" of the total likely affected numbers. "The evidence points to an effort to exploit a large number of devices within a narrow timeframe," he added.

Company Response and Ongoing Investigations

Fortinet spokesperson Tiffany Curci declined to specify how many customers have been compromised but assured that the company is "proactively communicating with customers." The identity of the perpetrators remains unclear, though cybersecurity expert Kevin Beaumont suggests that a ransomware operator might be involved.

Hostetler noted that ransomware attacks could potentially exploit this bug, referencing previous research where ransomware group affiliates utilized similar network providers for VPN connectivity.

Call for Immediate Action

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged all Fortinet users to promptly update affected devices. Previously, Fortinet disclosed a security breach in September involving customer data from a third-party cloud environment.