Apr 11, 2025
A recent security advisory from Fortinet has highlighted a concerning vulnerability in their security products. The issue, which affects multiple versions of Fortinet's software, allows attackers to maintain access to a network even after they've been detected and removed.
The vulnerability, identified as CVE-2024-48887, affects FortiOS versions 6.2.0 to 6.2.10, 6.4.0 to 6.4.8, and 7.0.0 to 7.0.5. It's a vulnerability in the authentication mechanism that allows attackers to create a persistent session, even after the user has logged out or the session has timed out.
To illustrate the severity of this vulnerability, consider a scenario where an attacker gains access to a hospital's network by exploiting a weak password. Once inside, they create a backdoor that allows them to access sensitive patient data, financial information, and other critical systems.
Even if the hospital's IT team detects the breach and removes the attacker, the backdoor remains, allowing the attacker to regain access and potentially launch further attacks, such as ransomware or data theft.
To address this vulnerability, Fortinet recommends that customers take the following steps:
In addition to updating to a patched version, customers can take several steps to mitigate the risk of this vulnerability: