FortiManager critical vulnerability under active attack

Fortinet has gone public with news of a critical flaw in its software management platform. The security vendor apparently began informing customers privately about the issue a few days ago but has since opened up about the issue in its FortiManager control software. The vulnerability, CVE-2024-47575, has a CVSS score of 9.8 …

[sanmigueelbeer]

Cisco October 2024 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication

Cisco Event Response: October 2024 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication

But the beauty is in Cisco Firepower Threat Defense Software for Firepower 1000, 2100, 3100, and 4200 Series Static Credential Vulnerability

"unauthenticated, local attacker to access an affected system using static credentials"

[Anonymous Coward]

Re: Cisco October 2024 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication

Trying to deflect attention away from Fortinet - Fine.

All software has vulnerabilities. The important things are:

1. Having a secure SDLC in place to prevent security issues from reaching customers, and

2. HOW YOU RESPOND when one does slip through. (Responsible disclosure AND 0-Day response.)

Fortinet and others are not looking good on those two metrics, and trend over time is not moving in the right direction...!

This is an industry-wide problem, not just related to Firewalls, etc, and will continue until either:

A. RFP's start to exclude bidders based on CVE's and response times, or

B. Cyber Insurance can be invalidated or be more expensive if an incumbent vendor has a poor record of developing secure code / responding to CVE's.

[sanmigueelbeer]

Re: Cisco October 2024 Cisco ASA, FMC, and FTD Software Security Advisory Bundled Publication

I was not making any attempts to "deflect" what has happened to Fortinet.

I was merely adding to the discussion of announced security vulnerability.

[Kurgan]

The cloud version?

What I don't get is "users of the cloud version". I mean, it's on Fortinet's servers, so why don't they patch it immediately? Why should a cloud user be still using an insecure version?

[Guy de Loimbard]

If they are producing patches, I don't see the issue, there are plenty of channels alerting end users to the vulnerability and the remedy, so get it on your patch cycle ASAP.

Surely it's not that hard to achieve, although I get the impression patching seems to be a challenge in most organisations.

[Anonymous Coward]

The issue is needing patches - repeatedly - for in-the-wild exploits of vulnerabilities.

Patching is HARD. Sure, easy to carry out, But arranging an out-of-cycle maintenance window without breaking any customer SLA's can be very hard.

At this point, FTNT could be seen as more of a liability than a security product.

[TrevorH]

Surely the issue is that they *silently* patched the vulnerability and released a new version without telling anyone that the bug existed or that it was fixed.