Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from Grey Noise | Grey Noise Blog
Summary: Over 15,000 Fortinet FortiGate firewalls were exposed in a breach tied to CVE-2022-40684, an authentication bypass disclosed in late 2022, and GreyNoise reports hundreds of these devices actively weaponized by attackers. Censys data cited in the post shows roughly 4,600 IPs still exposing their FortiGate web login interfaces as of January 2025, down from over 5,000 earlier, and GreyNoise published a list of 366 Fortinet IPs observed interacting with its sensors as of January 28.
Key Takeaway: Patches for CVE-2022-40684 have been available since October 2022, yet thousands of firewalls remained exposed in January 2025 - and the 366 IPs hitting GreyNoise sensors are already compromised and in use, not merely at risk.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-40684
- Related
- CVE-2022-40684: Fortinet Multiple Products Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Oct 11, 2022Storm Watch | Cyber Podcast | From Bans to Breaches: TikTok, PlugX, Forti Gate, and Salt Typhoon Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026