Fortinet Urges Updates to Fix Critical FortiWLM Vulnerability

December 19, 2024December 19, 2024

Critical Security Flaw in Fortinet’s Wireless LAN Manager: What You Need to Know

Fortinet has recently issued a critical advisory regarding a security vulnerability in its Wireless LAN Manager (FortiWLM), identified as CVE-2023-34990. This flaw, which has been patched, poses a serious risk as it could lead to the unauthorized disclosure of sensitive information. With a CVSS score of 9.6 out of 10, the potential for exploitation is significant, making it essential for users to update their systems promptly.

The vulnerability allows remote unauthenticated attackers to exploit a relative path traversal issue, enabling them to read sensitive files on affected versions of FortiWLM. This includes versions 8.6.0 through 8.6.5 (fixed in 8.6.6 or higher) and 8.5.0 through 8.5.4 (fixed in 8.5.5 or higher) source: NIST NVD.

Understanding CVE-2023-34990

According to Fortinet’s alert, the flaw stems from a lack of input validation on request parameters. This vulnerability could allow attackers to execute unauthorized commands via specially crafted web requests. Security researcher Zach Hanley from Horizon3.ai discovered this issue, highlighting that it can lead to severe consequences, including:

Unauthorized access to FortiWLM log files
Extraction of session IDs, enabling further exploitation of authenticated endpoints
Potential hijacking of web session IDs, granting administrative permissions to attackers

Connection to Other Vulnerabilities

This vulnerability does not exist in isolation. It can be combined with CVE-2023-48782, another high-risk flaw with a CVSS score of 8.8, which also has been fixed in FortiWLM 8.6.6. By exploiting both vulnerabilities, attackers could potentially gain remote code execution privileges in the context of root.

Impact on FortiManager

In addition to FortiWLM, Fortinet has also patched a high-severity operating system command injection vulnerability in FortiManager, tracked as CVE-2024-48889, with a CVSS score of 7.2. This flaw allows authenticated remote attackers to execute unauthorized code through FGFM-crafted requests. The affected versions include:

FortiManager 7.6.0 (fixed in 7.6.1 or above)
Various older versions down to 6.4.10 (fixed in 6.4.15 or above)

Protecting Your Fortinet Devices

Given the increasing targeting of Fortinet devices by cybercriminals, it is crucial for users to keep their systems updated. Ensure you are running the latest software versions to safeguard against potential threats stemming from these vulnerabilities.

For more detailed information on how to secure your network devices, visit the Fortinet Security Advisories.

Conclusion

The recent vulnerability in Fortinet’s Wireless LAN Manager serves as a stark reminder of the importance of cybersecurity vigilance. Users should prioritize updates to mitigate risks associated with CVE-2023-34990 and CVE-2024-48889.

Do you find this information helpful? Share your thoughts in the comments below, and for more insights into cybersecurity, follow us on Twitter and LinkedIn.

CISA Warns of Critical Flaws in Mitel and Oracle Systems

January 8, 2025January 8, 2025

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, focusing on Mitel MiCollab and Oracle WebLogic Server. Notable flaws include CVE-2024-41713 (CVSS 9.1) and CVE-2024-55550 (CVSS 4.4) in MiCollab, allowing unauthorized access to system files. Additionally, CVE-2020-2883 (CVSS 9.8) in WebLogic Server permits unauthenticated access via network protocols. CISA confirmed active exploitation of these vulnerabilities, prompting federal agencies to implement updates by January 28, 2025. Organizations are urged to remain vigilant against potential attacks.

Apple Fixes TCC Bypass Vulnerability in Latest Update

December 20, 2024December 20, 2024

Apple has fixed a critical vulnerability (CVE-2024-44131) in iOS 18, iPadOS 18, and macOS Sequoia 15 that could allow unauthorized access to sensitive user data by bypassing the Transparency, Consent, and Control (TCC) framework. The flaw, located in the FileProvider component, could enable attackers to manipulate file operations and redirect access to sensitive files without user alerts. Apple’s update enhances symbolic link validation, significantly improving security. Users are urged to update their devices promptly to protect against potential data breaches and stay informed about app permissions and unusual activity. Regular software updates are essential for user security.

Azure Airflow Flaws Could Expose Kubernetes Cluster to Attacks

December 31, 2024December 31, 2024

Cybersecurity experts have uncovered critical vulnerabilities in Microsoft’s Azure Data Factory integration with Apache Airflow, raising concerns about potential data exfiltration and malware deployment. Palo Alto Networks’ Unit 42 identified three main flaws, including misconfigured Kubernetes RBAC and weak authentication, which could enable attackers to gain unauthorized access. Exploitation could involve uploading malicious files to a linked GitHub repository, granting attackers shadow administrative control over the Airflow cluster. This situation highlights the importance of robust service permission management and monitoring. Additionally, a separate privilege escalation issue in Azure Key Vault further underscores the need for heightened security measures.

Transform Vulnerability Management into Exposure Management

December 5, 2024December 5, 2024

As cyber threats evolve, traditional Vulnerability Management (VM) is proving inadequate, prompting a shift towards Exposure Management (EM). A Gartner report highlights the need for organizations to integrate business context into security operations, moving beyond a purely technical focus. Key challenges with VM include stakeholder diversity, overwhelming vulnerability lists, and operational fatigue. EM emphasizes identifying critical assets and aligning cybersecurity with business objectives, enhancing decision-making and resource allocation. Effective engagement with leadership through meaningful metrics is crucial for support. This transition is essential for minimizing risks and ensuring operational continuity in today’s complex digital landscape.

Moxa Warns of Critical Router Vulnerabilities

January 7, 2025January 7, 2025

Moxa, a Taiwan-based technology company, has issued an urgent warning about two critical security vulnerabilities in its cellular routers and network security appliances. Reported by researcher Lars Haulin, CVE-2024-9138 allows privilege escalation via hard-coded credentials, while CVE-2024-9140 lets attackers bypass input restrictions to execute unauthorized commands. Affected products include several EDR and OnCell series with specific firmware versions. Moxa recommends upgrading to newer firmware and limiting internet exposure. Patches are available, and users are urged to implement security measures to safeguard against potential exploitation. Staying informed on such vulnerabilities is essential for user protection.

Critical SailPoint IdentityIQ Flaw Exposes Files to Hackers

December 4, 2024December 12, 2024

A critical security vulnerability (CVE-2024-10905) has been discovered in SailPoint’s IdentityIQ identity and access management software, posing a severe risk by potentially allowing unauthorized access to sensitive data. With a maximum CVSS severity score of 10.0, the flaw arises from improper file name handling, enabling HTTP access to protected static content. Affected versions include IdentityIQ 8.4 (prior to 8.4p2), 8.3 (prior to 8.3p5), and 8.2 (prior to 8.2p8), along with all earlier versions. Organizations are urged to update their software, review access controls, and monitor for vulnerabilities to mitigate risks.