CyberzSOC

On January 14, Fortinet released and updated several security advisories addressing multiple vulnerabilities ranging from low to critical severity [1]. At least one critical vulnerability is known to be exploited in the wild. It recommended updating as soon as possible, and if not possible, at least applying mitigations. in Node.js websocket module in FortiOS and FortiProxy which allow a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module. This vulnerability is exploited in the wild in possession of the key to execute unauthorised code via crafted cryptographic requests Fortinet also addresses 13 other high severity vulnerabilities. Considering that the vulnerability CVE-202455591 is exploited in the wild, it recommended to look for indicators of compromise (IoCs). When IoCs are found, it is recommended to trigger the Incident Response process.