iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Fortinet’s March 2023 investigation began when multiple FortiGate devices halted and then failed to boot because their firmware integrity checks detected changes. The company found a modified startup process, an added implant, and evidence of a FortiOS path-traversal vulnerability tracked as CVE-2022-41328. Fortinet assessed that the affected FortiGate devices were likely compromised through FortiManager; the published account does not independently establish every step of the intrusion or identify an attacker.
What happened
Fortinet published its detailed analysis of incident FG-IR-22-369 on March 9, 2023, after investigating multiple customer FortiGate devices that suffered sudden system halts and subsequent boot failures. The devices displayed: “System enters error-mode due to FIPS error: Firmware Integrity self-test failed”. Fortinet explains that FIPS-enabled devices check the integrity of system components and shut down rather than boot when they detect a breach. Fortinet’s analysis characterized the exploitation as highly targeted at government or government-related organizations, and also identified large organizations among impacted users.
A contemporaneous SecurityWeek report published March 14, 2023 described the activity as zero-day exploitation and identified CVE-2022-41328 as a medium-severity path-traversal flaw. The CVE identifier includes 2022, but Fortinet published its advisory on March 7, 2023, and the detailed investigation on March 9, 2023.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Fortinet found on the FortiGate devices
Modified startup files and an implant
On inspected devices, Fortinet found that /sbin/init had been modified and /bin/fgfm had been added. The change caused the added file to run before ordinary startup actions, creating a way for the attacker to maintain access and control.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Fortinet described fgfm as checking ICMP packets for a particular marker, extracting an address, and connecting to a command-and-control server. Its listed capabilities included exiting, exfiltrating data, writing downloaded files, and opening a remote shell.
Why Fortinet suspected FortiManager
Fortinet assessed that FortiManager was the likely route used to compromise the affected FortiGate devices. It cited three connected observations: the devices detected the attack and halted at about the same time, they showed the same compromise pattern, and logs recorded a path-traversal attempt at the same time scripts were run through FortiManager. This is Fortinet’s assessment from its investigation, not an independently verified reconstruction of every step in the attack chain.
Rank #2
- INTEGRATED FIREWALL APPLIANCE AND SECURITY SERVICES: Comes with FortiGate-40F Firewall Appliance, 1 year of FortiCare Premium, and FortiGuard Unified Threat Protection.
- UTP SECURITY FEATURES: Offers protection from advanced threats with DNS filtering, URL filtering, video filtering, and controls against botnets.
- IDEAL FOR SMALLER SETTINGS: Best suited for small to mid-sized businesses needing reliable security without the complexity of larger systems.
- CONTINUOUS SUPPORT AND MAINTENANCE: FortiCare Premium ensures that technical help is readily available to manage and troubleshoot issues.
- COMPACT AND EFFECTIVE: Provides a powerful, yet compact security solution that effectively protects against a wide range of cyber threats.
The path-traversal attempt
Logs showed FortiManager-delivered scripts and an attempted path traversal that could allow arbitrary files to be uploaded to a FortiGate using a TFTP server and a specified path. Investigators saw an attempted replacement of /bin/lspci. Fortinet noted that a malicious replacement could potentially be executed through a CLI diagnostic command.
Fortinet assigned CVE-2022-41328 to this FortiOS path-traversal vulnerability and said it fixed supported FortiOS versions. The reviewed analysis does not provide an affected-and-fixed release matrix, so this historical account should not be used to determine whether a particular present-day installation is vulnerable.
Rank #3
- Extensive Connectivity Options: The FortiGate 60F is designed with 10 GE RJ45 ports, including 2 WAN ports, 1 DMZ port, and 7 internal ports, offering broad flexibility and high-density connections for diverse enterprise networking needs.
- Superior Performance for Secure Networks: Features powerful system-on-a-chip acceleration to deliver top-tier security with 1.4 Gbps IPS throughput and 700 Mbps threat protection throughput, ensuring effective defense against advanced threats.
- Enhanced SSL Inspection and SD-WAN Capabilities: Utilizes purpose-built security processor technology to provide the industry's highest SSL inspection performance and robust SD-WAN functionality for secure, high-speed network operations.
- Simple and Effective Management: Comes equipped with a user-friendly management console that supports comprehensive network automation and visibility, alongside Zero Touch Integration with Fortinet's Security Fabric for streamlined deployment.
- Advanced Security Features: Leverages continuous threat intelligence from AI-powered FortiGuard Labs, identifying and mitigating both known and unknown threats, enhancing security across all network traffic, whether encrypted or not.
What investigators found in FortiManager firmware
Fortinet compared the involved FortiManager firmware image with a clean device image and found changed and added files, a modified startup script, and modifications to Django components. The company said these changes could provide persistence and control. Its analysis describes components able to run shell commands, transfer files, redirect traffic, query interfaces, and expose an additional command-execution endpoint.
One modified component disabled firmware verification at boot. A startup script later re-enabled verification; Fortinet suggested this sequence could mask the modification. These findings describe what Fortinet identified in the firmware comparison, but do not by themselves establish the full path by which every component was installed or used.
Rank #4
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
What the integrity failure tells defenders
In this incident, the integrity self-test surfaced a breach by preventing affected FIPS-enabled devices from booting normally. It was a detection signal, not a complete account of the intrusion: the message indicates that a firmware integrity check failed, while the investigation was needed to identify modified files, the implant, and the suspected route through FortiManager.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Fortinet published specific log strings, the network indicator 47.252.20.90, and hashes for files including Auth, Klogd, Support, Smit, Localnet, Urls.py, Views.py, and Fgfm. For operational use, consult the original Fortinet analysis for the exact indicator values and context. A string, address, or hash is an investigative lead; it is not, on its own, proof that a device is affected or unaffected.
Best Value
- Robust Port Configuration: The FortiGate 120G is equipped with 18 GE RJ45 ports, including 1 management port and 1 HA port, alongside 16 switch ports. It also features 8 GE SFP slots and 4 10GE SFP+ slots, providing versatile connectivity options for complex network setups.
- Cutting-edge Performance with SP5 Acceleration: Powered by SP5 hardware acceleration, the device ensures unmatched performance, making it ideal for enterprises requiring rapid application identification, efficient business operations, and robust security.
- Dual AC Power Supplies: Designed with dual non-hot swappable AC power supplies, the FortiGate 120G ensures uninterrupted service and operational reliability, critical for maintaining mission-critical network activities.
- Superior Security Features: Integrated with Fortinet’s Security Fabric, the FortiGate 120G offers advanced threat protection, real-time SSL inspection, and AI-powered FortiGuard services, providing comprehensive defense against modern cyber threats.
- Streamlined Network Management: Features such as the FortiLink protocol allow seamless integration of security and network management, enabling centralized control and simplified operations across all networked FortiGate devices.
What is known about the attacker—and what is not
Fortinet said the exploit’s complexity suggested an advanced actor, pointing to the need for deep FortiOS and hardware knowledge and custom implants indicating reverse-engineering capability. It described a preference for government or government-related targets. Neither Fortinet’s analysis nor the contemporaneous report names an actor or establishes state sponsorship. Sophistication and target profile are not enough to infer identity.
How to use this account for current response
This is a historical incident account, not current patch guidance. Organizations investigating a FortiGate or FortiManager should use Fortinet’s current PSIRT advisory and incident-response guidance, checking the installed product and version against the live vendor information. The 2023 analysis’s general statement that supported FortiOS versions were fixed does not establish the applicable version status today.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
