A design flaw in the logging mechanism of Fortinet’s VPN servers has been uncovered, allowing attackers to conduct brute-force attacks without detection.
This vulnerability, disclosed by cybersecurity researchers at Pentera, highlights a critical gap in Fortinet’s ability to log successful authentication attempts during brute-force attacks, leaving enterprises vulnerable to potential breaches.
The issue lies in how Fortinet VPN servers handle authentication and authorization processes. When a user attempts to log in, the server responds with one of three outcomes: valid credentials, failed authentication, or an error due to excessive failed attempts.
However, successful authentication attempts are only logged after the authorization phase, which establishes the VPN session.
If an attacker stops at the authentication phase—where credentials are verified but no session is created—the successful attempt goes unlogged.
Download the Forrester TEI Study now and sign up for guidance to maximize cybersecurity ROI.
This creates a significant blind spot for incident response (IR) teams. Failed login attempts are recorded, but successful brute-force attempts remain invisible.
Consequently, attackers can validate leaked credentials without alerting security teams or triggering alarms, Pentera said.
The inability to log successful authentication attempts poses severe risks:
While Fortinet does not classify this issue as a vulnerability, researchers argue that it undermines security and recommend immediate action:
Until Fortinet addresses this issue, organizations can take proactive measures:
This flaw underscores the importance of robust logging and monitoring practices in securing enterprise networks. While the vulnerability does not currently have a fix from Fortinet, organizations must act swiftly to implement compensating controls and reduce their attack surface.
Are you from SOC/DFIR Teams? – Analyse Malware & Phishing with ANY.RUN -> Try for Free
A critical command injection vulnerability in the popular systeminformation npm package has recently been disclosed, exposing millions…
Researchers discovered a malware campaign targeting the npm ecosystem, distributing the Skuld info stealer through…
An investigation revealed an intrusion in Asia involving the BellaCiao .NET malware, as the initial…
A seemingly benign health app, "BMI CalculationVsn," was found on the Amazon App Store, which…
The Lazarus Group has recently employed a sophisticated attack, dubbed "Operation DreamJob," to target employees…
NodeStealer, initially a JavaScript-based malware, has evolved into a more sophisticated Python-based threat that targets…