Fortinet Backdoor: Over 16,000 Devices Affected

More than 16,000 Fortinet devices globally have been found to be compromised with a persistent symlink backdoor. It’s a vulnerability that allows read-only access to sensitive configuration files even after patching. Initially reported to affect 14,000 devices, that number has since climbed to over 16,620 according to The Shadowserver Foundation, exposing a wide-scale security oversight in FortiGate firewall management.

As BleepingComputer first reported, the issue stems from attacks dating back to 2023, where threat actors exploited zero-day vulnerabilities in FortiOS. In these attacks, hackers created symbolic links in the language files folder to the root file system on devices with SSL-VPN enabled. With this setting enabled, the language files were publicly accessible, allowing threat actors to use the symbolic link to gain persistent read access to the root file system.

This move effectively granted remote access to a device’s root file system without the need for active exploitation of a current vulnerability. The symbolic links persisted even after software updates.

Further insight from The Register revealed that these symlinks were crafted using three known vulnerabilities, two of which being previously exploited by the Chinese-backed Void Typhoon group.

“We have seen, numerous times, attackers deploy capabilities and backdoors after rapid exploitation designed to survive the patching, upgrade and factory reset processes organizations have come to rely on to mitigate these situations to maintain persistence and access to compromised organizations,” said Benjamin Harris, CEO of WatchTowr.

In response, Fortinet has rolled out firmware updates and an updated AV/IPS signature to detect and remove the symlink. Private email alerts have also been sent to impacted clients.

Just this year, we reported a breach where the newly surfaced “Belsen Group” leaked configuration files and VPN credentials from over 15,000 FortiGate devices. The scale and persistence of these attacks highlight potential issues in Fortinets’ approach to cybersecurity.