Skip to main content
عربي
logo

NCSC-TAD-2104-001

Severity Level: Critical
Vulnerability

Reference No.: NCSC-TAD-2104-001CVSS 0

APT Groups Exploiting Fortinet SSL VPN

Threat Type:
N/A
TLP:
CLEAR
CVE:
CVE-2018-13379, CVE-2020-12812, CVE-2019-5591

Overview

Three security vulnerabilities in the Fortinet SSL VPN are being used to gain a foothold within networks before moving laterally and carrying out recon.

Advanced persistent groups (APT) are successfully leveraging previously disclosed vulnerabilities in the Fortinet FortiOS cybersecurity operating system, which affects the company’s SSL VPN products. The attackers are looking for unpatched Fortinet security implementations by scanning devices on ports 4443, 8443 and 10443. APT actors are likely scanning for these vulnerabilities in order to gain access to a range of government, commercial and technology services networks.

Affected Technologies

  • Fortinet FortiOS
  • SSL VPN products

Mitigation and Immediate Actions

  1. 01

    Immediately patch the following vulnerabilities CVEs 2018-13379, 2020-12812 and 2019-5591.

  2. 02

    If FortiOS is not used by your organization, add key artifact files used by FortiOS to your organization’s execution-deny list. Any attempts to install or run this program and its associated files should be prevented.

  3. 03

    Regularly back up data, air-gap and password/protect backup copies offline.

  4. 04

    Implement network segmentation.

  5. 05

    Require administrator credentials to install software.

  6. 06

    Implement a recovery plan to restore sensitive or proprietary data from physically separate hard drive.

  7. 07

    Install updates/patch operating systems, software, and firmware as soon as updates/patches are released.

  8. 08

    Disable unused remote access.

  9. 09

    Audit user accounts with administrative privileges.

  10. 10

    Install and regularly update antivirus and anti-malware.

References