Skip to main content

Fortinet Switches: The Patch You Can't Ignore

 

Introduction

Looking online this time at the hacker news a website I like for cyber security news articles. I find them to be clear and concise. Which is where  I found this article (Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw) on a vulnerability in Fortinet switches.

The Vulnerability

A vulnerability with a 9.3 out of 10 CVSS score, the CVE can be found here (https://nvd.nist.gov/vuln/detail/CVE-2024-48887).

A 9.3 CVSS score indicates a critical vulnerability with severe risks, including unauthorized access, system compromise, and service disruptions. Immediate action is crucial for mitigation. Prompt patch management is necessary to protect infrastructure integrity and safeguard clients and stakeholders who depend on secure and reliable services.

The article identifies a vulnerability in the switches, where an attacker can alter the administrative password through a specifically crafted request.

What is being done

Fortinet have released a patch for the vulnerability the article also gives a list of the vulnerable versions of the switches GUI and which version to upgrade to.

Currently at the time of writing there has been no evidence to show that this flaw has been exploited in the wild.

My take aways from the article

I think the key takeaway from this is the critical importance for technology companies to address vulnerabilities promptly and thoroughly. When a vulnerability with a high CVSS score like 9.3 is discovered, it underscores the potential for significant risks, including unauthorized access, system compromise, and service disruptions. The release of a patch is a vital step, but its efficacy depends on timely and proper installation by users.

In the case of Fortinet switches, the article highlights how an attacker can manipulate the administrative password, making it essential for users to stay vigilant and proactive in updating their systems. The absence of evidence showing that the flaw has been exploited in the wild offers some reassurance, but it should not lead to complacency.

Furthermore, this situation serves as a reminder of the broader implications for cybersecurity practices. Technology companies must not only develop patches quickly but also communicate effectively with their users about the urgency and steps required for mitigation. Users, on the other hand, need to prioritize these updates to ensure the integrity and security of their infrastructure, which is crucial in maintaining trust among clients and stakeholders.

Labels:

Comments

Post a Comment

Popular posts from this blog

Retail Ransom: The UK's Cyber Crisis

In the last few weeks, Recent cyberattacks on the UK retail sector have made headlines in particular M&S, Harrods, and the CO-OP. These attacks have hit retailers hard, with M&S losing £1 billion in market value alone. Retailers have faced empty shelves, electronic payment failures, and delayed deliveries as a result. A blog post from the NCSC on the 4 th May 2025 says  “Whilst we have insights, we are not yet in a position to say if these attacks are linked, if this is a concerted campaign by a single actor or whether there is no link between them at all. We are working with the victims and law enforcement colleagues to ascertain that.”   Quote from NCSC blog post https://www.ncsc.gov.uk/blog-post/incidents-impacting-retailers A cybercriminal group known as Scattered Spider appears to be the likely culprit. Who is Scattered Spider? Scattered Spider is a cybercriminal group known for targeting large organizations, particularly in retail, finance, telecoms,...
Post a Comment
Read more

Root of the Problem: Linux Flaws That Give Attackers Admin Rights

 I realised that I haven’t posted to my blog in a long time and this week an article about CVE’s in linux caught my eye and that was the perfect excuse to write another blog post. Cybersecurity researchers at Qualys have uncovered two critical local privilege escalation (LPE) flaws that are shaking the foundations of Linux security. These aren't your run-of-the-mill vulnerabilities; we're talking about direct, express lanes to full root access on major Linux distributions. If you use Ubuntu, Debian, Fedora, openSUSE Leap 15, or SUSE Linux Enterprise 15, you need to pay close attention. The Double Threat: CVE-2025-6018 & CVE-2025-6019 An article detailing the CVE’s can be found at the link below ( CVE-2025-6018 and CVE-2025-6019 Vulnerability Exploitation: Chaining Local Privilege Escalation Flaws Lets Attackers Gain Root Access on Most Linux Distributions | SOC Prime )     Qualys has pulled back the curtain on two distinct, yet chainable, vulnerabilit...
Post a Comment
Read more

Virtual Beginnings: The First Layers of My Lab

Thank you for joining me on this journey in to cybersecurity, I have a home lab and will be posting here about how I set it up and the practical exercises I do along my journey. Currently I have a Windows 11 PC with virtualbox installed. I have kali linux, metasploitable, and 4 Linux distros for endpoints. (mint, fedora, elementary and zorin). I will be expanding and changing my lab as my journey progresses. My next steps will be to install a SIEM for this I’ll be using wazuh and elastic stack.
Post a Comment
Read more