CISA Orders Patching of Exploited Fortinet Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) issued a directive on Thursday, compelling federal agencies to immediately address two critical vulnerabilities within the Fortinet FortiSandbox threat detection platform. These vulnerabilities, identified as CVE-2024-3657 and CVE-2024-3658, are reportedly being actively exploited by malicious actors.

Fortinet's advisory indicates that CVE-2024-3657 is a command injection vulnerability affecting FortiSandbox versions 4.0.0 through 4.2.3. Exploiting this flaw could allow an unauthenticated attacker to execute arbitrary code with root privileges on the affected device. CVE-2024-3658, also a command injection vulnerability, impacts FortiSandbox versions 4.0.0 through 4.2.3 and could permit an unauthenticated attacker to execute commands with root privileges.

CISA's directive mandates that agencies must apply available patches or implement mitigating measures by June 20, 2024. The agency emphasizes that failure to comply could result in significant security risks, including unauthorized access and data compromise. This urgent action underscores the severity of the threats posed by these actively exploited vulnerabilities, highlighting the need for prompt remediation to protect critical infrastructure and sensitive data.

Fortinet has released updated versions of FortiSandbox that address these security flaws. Agencies are advised to consult Fortinet's security advisories for detailed information on the affected versions and the recommended patching procedures. CISA's Binding Operational Directive 24-02 provides further guidance on vulnerability management and remediation for federal civilian executive branch agencies.