Alert status HIGH Background The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) advises organisations using Fortinet devices that Advanced Persistent Actors (APT’s) have been observed exploiting the following vulnerabilities: CVE-2018-13379 - Fortinet Path Traversal CVE-2020-12812 - Fortinet 2 Factor Authentication bypass CVE-2019-5591 - Fortinet Man-in-the-middle by LDAP impersonation US Cybersecurity and Infrastructure Security (CISA) and the Federal Bureau of Investigation (FBI) have published a joint advisory on this issue Joint CSA AA21-092A: APT Actors Exploit Vulnerabilities to Gain Initial Access for Future Attacks (ic3.gov). This advisory highlights that APT’s have been observed to leverage these vulnerabilities to specifically enable the theft, encryption and destruction of data on vulnerable networks. Mitigations The primary mitigation against these attacks is to patch the vulnerabilities listed above. If patching is not immediately possible, organisations should consider removing internet access from Fortinet devices until other mitigations listed in the CISA joint advisory can be implemented. Assistance The ACSC is monitoring the situation and is able to provide assistance and advice as required. Organisations that have been impacted or require assistance can contact the ACSC via 1300 CYBER1. Content complexity Moderate This rating relates to the complexity of the advice and information provided on the page.
