bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

SSH backdoor at Fortinet too?

Summary

In January 2016 a Python script appeared on Full Disclosure that provided unauthorised SSH access to Fortinet’s FortiGate firewalls in versions 4.x to 5.0.7. The undocumented mechanism looked suspiciously like a backdoor; Fortinet had already quietly fixed the problem in 2014. Shortly before, Juniper had had to admit that its products contained several backdoors.

Ideas

  • A hard-coded access bypassed normal authentication.
  • Fixing silently without notice leaves customers in the dark about their risk.
  • Ralf-Philipp Weinmann confirmed the backdoor shortly after publication.

Insights

  • Undocumented access cannot be distinguished from backdoors, however it was intended.
  • Transparency about security fixes is part of product quality.

Facts

  • FortiOS 4.x to 5.0.7 was affected.
  • Fortinet had applied the change in 2014 without notice.
  • Fortinet spoke of a “management authentication issue” and a patch from July 2014.
  • The release notes of FortiOS 5.0.8 did not mention an SSH hole.

References

Critique

  • The report cannot clarify Fortinet’s intention and leaves the question of purpose open.

Recommendations

  • Only make the SSH and web interfaces of firewalls reachable from a management network.
  • Treat silent security fixes as a warning sign when choosing a vendor.

Read the original article

Search the Web Archive

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2026

Ongoing attacks endanger 10,000 firewalls

At the end of 2025 Fortinet warned of ongoing attacks on a FortiOS hole patched since July 2020 (CVE-2020-12812), which according to Shadowserver was still exploitable on around 10,000 firewalls. Attackers use it to bypass two-factor login via FortiToken by changing the upper and lower case of the user name. Local users authenticated via LDAP and assigned to a group are affected.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.