CERT-In Advisory
CIAD-2021-0034
Compromised Credentials of Fortinet VPN Devices
Original Issue Date: September 16, 2021
Description
It has been observed that malicious threat actors targeting unpatched Fortinet VPN devices and leveraging stolen credentials. The exploitation targets a known vulnerability (CVE-2018-13379) that has been patched in newer versions of firmware. Organizations that are using vulnerable Fortinet appliances must update or disconnect their devices immediately, and reset all passwords and/or enable Multi-Factor Authentication (MFA).
Best Practices
- Immediately upgrade affected devices to the latest available release. The patched versions are FortiOS 5.4.13, 5.6.14, 6.0.13, or 6.2.9 and above.
- Consider all credentials as potentially compromised by performing an organization-wide password reset.
- Implement multi-factor authentication, which will help mitigate the abuse of any compromised credentials, both now and in the future.
- Reset all users¿ password for user¿s accounts. Notify users to explain the reason for the password reset and monitor services such as HIBP for your domain. There is the potential that if passwords have been reused for other accounts, they could be used in credential stuffing attacks.
- Examine the logs to analyze any suspicious activity. If anything looks suspicious you should immediately perform a thorough investigation to identify the vulnerable activity.
- Remove any unauthorized VPN related settings and rules configured by the attackers.
Vendor Information
Fortinet
https://www.fortinet.com/blog/psirt-blogs/malicious-actor-discloses-fortigate-ssl-vpn-credentials
References
Fortinet
https://www.fortinet.com/blog/psirt-blogs/malicious-actor-discloses-fortigate-ssl-vpn-credentials
https://www.fortiguard.com/psirt/FG-IR-18-384
https://www.fortiguard.com/psirt/FG-IR-20-233
MalwareBytes
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/500000-fortinet-vpn-credentials-exposed-turn-off-patch-reset-passwords/
CVE Name
CVE-2018-13379
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|