Security News > 2024 > March > Exploit released for Fortinet RCE bug used in attacks, patch now
Security researchers have released a proof-of-concept exploit for a critical vulnerability in Fortinet's FortiClient Enterprise Management Server software, which is now actively exploited in attacks.
On Thursday, one week after Fortinet released security updates to address the security flaw, security researchers with Horizon3's Attack Team published a technical analysis and shared a proof-of-concept exploit that helps confirm if a system is vulnerable without providing remote code execution capabilities.
Those who want to use Horizon3's exploit code in RCE attacks must modify the PoC to use the Microsoft SQL Server xp cmdshell procedure to spawn a Windows command shell for code execution.
In February, Fortinet patched another critical RCE bug in the FortiOS operating system and FortiProxy secure web proxy, saying it was "Potentially being exploited in the wild."
It's also worth noting that Fortinet security vulnerabilities are frequently used to gain unauthorized access to corporate networks for ransomware attacks and cyber espionage campaigns, often using zero-day exploits.
News URL
Related news
- Exploit released for Palo Alto PAN-OS bug used in attacks, patch now (source)
- Exploit available for new critical TeamCity auth bypass bug, patch now (source)
- Microsoft March 2024 Patch Tuesday fixes 60 flaws, 18 RCE bugs (source)
- Fortinet warns of critical RCE bug in endpoint management software (source)
- Ivanti fixes VPN gateway vulnerability allowing RCE, DoS attacks (source)
- Critical RCE bug in 92,000 D-Link NAS devices now exploited in attacks (source)
- Microsoft April 2024 Patch Tuesday fixes 150 security flaws, 67 RCEs (source)
- Palo Alto firewalls: Public exploits, rising attacks, ineffective mitigation (source)
- Hackers Exploit Fortinet Flaw, Deploy ScreenConnect, Metasploit in New Campaign (source)
- Maximum severity Flowmon bug has a public exploit, patch now (source)