CISA Order Highlights Persistent Risk at Network Edge
Summary: CISA ordered federal agencies to respond within 14 days to reports of misconfigured or Internet-exposed networking equipment and to restrict management interface access to authorized users on local or internal networks. The directive followed Mandiant's finding that a previously unidentified Chinese hacking group had exploited a zero-day in Barracuda Networks email security gateway appliances since at least October 2022, and Fortinet's confirmation that CVE-2023-27997 in its FortiOS firmware was being actively exploited, with Shodan reporting more than a half-million vulnerable Fortinet devices reachable via the public Internet.
Key Takeaway: More than a half-million Fortinet devices were reachable on the public Internet, and reaching the management interface of a vulnerable SSL VPN appliance was enough to fully compromise it - pre-authentication, on every appliance.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-27997
- Related
- CVE-2023-27997: Fortinet FortiOS and Forti Proxy SSL-VPN Heap-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 13, 2023Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026