{"id":7583,"date":"2020-12-02T21:21:11","date_gmt":"2020-12-03T04:21:11","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7583"},"modified":"2023-04-05T12:42:35","modified_gmt":"2023-04-05T19:42:35","slug":"fortinets-50000-vpn-leak-highlights-lack-of-cyber-hygiene","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/fortinets-50000-vpn-leak-highlights-lack-of-cyber-hygiene\/","title":{"rendered":"Fortinet\u2019s VPN Leak Highlights the Lack of Cyber Hygiene"},"content":{"rendered":"
\n

A threat hacker group named \u201cPumpedkicks\u201d has leaked credentials for 50,000 Fortinet VPN devices that impact 140 countries around the world. Check out Securin\u2019s analysis and recommendations for this vulnerability.<\/strong><\/span><\/span><\/p>\n<\/blockquote>\n

This breach was noticed five days ago by Bank Security, which tweeted that 49,577 IPs are vulnerable to the Fortinet SSL VPN vulnerability CVE-2018-13379<\/a>. The threat actors have also posted one-line exploits that could be used on CVE-2018-13379 to steal VPN credentials from these devices.<\/span><\/span><\/p>\n

\"\"<\/span><\/span><\/p>\n

This vulnerability exists in Fortinet with an improper limitation of a path name to a restricted directory (\u201cPath Traversal\u201d) issue, and it affects FortiOS 6.0.0<\/strong>\u00a0to 6.0.4, 5.6.3 to 5.6.7<\/strong>, and\u00a05.4.6 to 5.4.12. <\/strong>Under the SSL VPN web portal, it allows an unauthenticated attacker to download system files via specially crafted HTTP resource requests. The NVD has rated this vulnerability with a CVSS V3 Score of 9.8 marked as critical severity.<\/span><\/span><\/p>\n

Securin’s researchers analyzed and found the following information about this vulnerability:<\/span><\/span><\/p>\n\n\n\n\n\n
CVE ID<\/strong><\/span><\/span><\/th>\n\u00a0Exploits\u00a0\u00a0<\/strong><\/span><\/span><\/th>\nAPT <\/strong><\/span><\/span>Group\u00a0<\/strong><\/span><\/span><\/th>\nMitigation<\/strong><\/span><\/span><\/th>\n<\/tr>\n<\/thead>\n
\u00a0CVE-2018-13379\u00a0<\/span><\/span><\/td>\nWeb App<\/span><\/span><\/a><\/td>\nAPT5<\/span><\/span><\/td>\n\n

Fortinet\u00a0Mitigation<\/a><\/span><\/span><\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

CISA and the FBI issued<\/a> a warning last month underlining attacks on the US government’s local, tribal, and territorial networks in which attackers merge VPN and Windows vulnerabilities.<\/span><\/span><\/p>\n

This breach affects many large enterprises, financial institutions, and government organizations worldwide. The USA tops the list of countries with more than 10,000 vulnerable devices, followed by China and Japan.<\/span><\/span><\/p>\n

The following is the list of affected countries and the count of vulnerable devices.\u00a0<\/span><\/span><\/p>\n