Fortinet Fiasco: Wireless Manager Vulnerability Lurks for 10 Months!
Fortinet Wireless Manager’s critical vulnerability, CVE-2023-34990, had a four-month zero-day period, allowing attackers to hijack admin sessions using verbose logs. Despite warnings, users remained unaware due to delayed security bulletins. Admins should promptly update FortiWLM to avoid network chaos and accidental time travel to the Stone Age.
Hot Take:
Fortinet’s FortiWLM vulnerability saga is the cybersecurity equivalent of leaving your front door wide open and then wondering why your house got robbed. It took nearly as long as a Netflix series renewal for them to patch it up, but hey, at least they finally got around to it!
Key Points:
- Fortinet Wireless Manager (FortiWLM) had a critical vulnerability, allowing remote code execution.
- The flaw, CVE-2023-34990, scored a 9.8 and involved a path traversal issue.
- Discovery by Horizon3 researcher Zach Hanley took place in May 2023, but public disclosure happened in March 2024.
- Fortinet released a security bulletin on December 18, 2024, nine months after the issue became public.
- Admins are urged to update to FortiWLM versions 8.6.6 and 8.5.5 to mitigate the vulnerability.
Already a member? Log in here