{"id":55287,"date":"2024-02-09T14:30:14","date_gmt":"2024-02-09T14:30:14","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/fortinets-week-to-forget-critical-vulns-disclosure-screw-ups-and-that-toothbrush-ddos-attack-claim\/"},"modified":"2024-02-09T14:30:14","modified_gmt":"2024-02-09T14:30:14","slug":"fortinets-week-to-forget-critical-vulns-disclosure-screw-ups-and-that-toothbrush-ddos-attack-claim","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fortinets-week-to-forget-critical-vulns-disclosure-screw-ups-and-that-toothbrush-ddos-attack-claim\/","title":{"rendered":"Fortinet’s week to forget: Critical vulns, disclosure screw-ups, and that<\/em> toothbrush DDoS attack claim"},"content":{"rendered":"

We’ve had to write the word “Fortinet” so often lately that we’re considering making a macro just to make our lives a little easier after what the company’s reps will surely agree has been a week sent from hell.<\/p>\n

It all culminated this Friday with the disclosure of yet another critical security vulnerability in FortiOS, impacting its SSL VPN.<\/p>\n

Tracked as CVE-24-21762<\/a>, the 9.6 severity out-of-bounds write issue allows for remote unauthenticated attackers to achieve code execution. There’s also evidence to suggest it’s already been exploited as a zero-day.<\/p>\n