bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

Ongoing attacks endanger 10,000 firewalls

Summary

At the end of 2025 Fortinet warned of ongoing attacks on a FortiOS hole patched since July 2020 (CVE-2020-12812), which according to Shadowserver was still exploitable on around 10,000 firewalls. Attackers use it to bypass two-factor login via FortiToken by changing the upper and lower case of the user name. Local users authenticated via LDAP and assigned to a group are affected.

Ideas

  • Different handling of upper and lower case between systems opens a hole.
  • A five-year-old patch is useless if it is not installed.
  • As an alternative, Fortinet recommended disabling the “username-case-sensitivity” option.
  • Vulnerable systems should be considered potentially compromised.

Insights

  • Two-factor authentication is only as strong as the user name check before it.
  • Old, known holes remain a main attack path on perimeter devices.

Facts

  • FortiOS up to 6.4.0, 6.2.3 and 6.0.9 is affected; fixed in 6.4.1, 6.2.4 and 6.0.10.
  • On 4 January 2026, 9,658 systems were still vulnerable, 48 of them in Germany.

References

Critique

  • The report does not say what the ongoing attacks look like in concrete terms or who is behind them.

Recommendations

  • Check firewalls for outdated firmware, even if the hole is years old.
  • Treat a firewall that has long been vulnerable as compromised and examine accounts and configuration.

Read the original article

Search the Web Archive

g · 2025

Partly critical router holes endanger industrial networks

In January 2025 the industrial network equipment supplier Moxa warned of two holes in routers and security appliances used, among other places, in energy facilities. CVE-2024-9138 is based on hard-coded credentials and gives authenticated attackers root privileges; the critical CVE-2024-9140 allows system commands to be injected. Firmware updates were available for several model series, while for others there were only workarounds or a referral to support.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.