Analysis: Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass

Vulnerable Fortinet Firewalls Pose a Persistent Threat

A five-year-old critical two-factor authentication (2FA) bypass vulnerability in Fortinet firewalls continues to pose a significant threat, with over 10,000 devices still unpatched and exposed online. This ongoing issue underscores the importance of timely security updates and best practices in network security.

The Flaw and Its Impact

First discovered in 2020, the flaw (CVE-2020-12812) allows attackers to bypass the second factor of authentication (FortiToken) on unpatched firewalls. This improper authentication security flaw, rated 9.8/10 in severity, is found in FortiGate SSL VPN. Attackers can log in without being prompted for the second factor of authentication when the username's case is changed.

Ongoing Attacks and Global Exposure

Recent reports indicate that attackers are still exploiting this vulnerability, targeting firewalls with vulnerable configurations that require LDAP (Lightweight Directory Access Protocol) to be enabled. As of last week, Internet security watchdog Shadowserver tracks over 10,000 Fortinet firewalls still exposed on the Internet, with over 1,300 IP addresses in the United States.

Relevance to North East India and Broader Indian Context

Given the widespread nature of this vulnerability, it is likely that some networks in North East India and the rest of India are also affected. It is crucial for organizations to assess their network security and ensure they are not among the vulnerable devices. Failure to do so could lead to potential breaches, data theft, and other cybersecurity incidents.

Implications and Future Considerations

The persistent exploitation of this five-year-old vulnerability highlights the need for organizations to prioritize timely security updates and proactive network security measures. It also underscores the importance of multi-factor authentication and the need for strong password policies to enhance security. As cyber threats continue to evolve, staying vigilant and up-to-date is key to maintaining a secure digital environment.