Security News > 2024 > February > Fortinet's week to forget: Critical vulns, disclosure screw-ups, and that toothbrush DDoS attack claim

The only workaround recommended by Fortinet is to disable the SSL VPN. Disabling webmode won't mitigate the vulnerability, it said.

Firstly, Fortinet backtracked and said these weren't vulnerabilities at all, instead explaining that they were issued in error and were duplicates of the single vulnerability mentioned in the aforementioned October advisory - CVE-2023-34992.

Due to exceptional circumstances that include the premature dissemination of mitigation guidance and in an effort to help protect our customers, Fortinet distributed its monthly advisory on February 8 ahead of its anticipated February 13 publication date to provide important details to customers considering these circumstances.

For more on Fortinet's responsible disclosure process, visit the Fortinet Product Security Incident Response Team.

The reporter at the Swiss German daily which originally reported the story then snapped back with a comeback that refuted Fortinet's response, saying: "What the Fortinet headquarters in California is now calling a 'translation problem' sounded completely different during the research: Swiss Fortinet representatives described the toothbrush case as a real DDoS at a meeting that discussed current threats."

The Swiss reporter also said the article was proofread by Fortinet before publication and nothing in the report was corrected by the vendor.

News URL

https://go.theregister.com/feed/www.theregister.com/2024/02/09/a_look_at_fortinet_week/