Recommended Free Tools
SecurityWeek reported on August 22, 2019, that researchers had observed scanning attempts targeting two enterprise VPN vulnerabilities: CVE-2018-13379 in FortiOS SSL VPN and CVE-2019-11510 in Pulse Connect Secure. The report described attempts to find vulnerable systems—not confirmed breaches—and is historical, not a warning that the same activity is occurring now.
Which vulnerabilities were targeted?
Both flaws were reported to let a remote attacker without authentication access arbitrary files on a vulnerable system. They affected different products and used different vulnerability types.
| Vendor and product | CVE | Reported flaw and impact | First observed attempts in the 2019 report |
|---|---|---|---|
| Fortinet FortiOS SSL VPN web portal | CVE-2018-13379 | Path traversal; remote, unauthenticated access to arbitrary files, according to SecurityWeek’s August 22, 2019 report. | August 21, 2019, as reported by SecurityWeek. |
| Pulse Secure Pulse Connect Secure | CVE-2019-11510 | Arbitrary file read; remote, unauthenticated access to arbitrary files, according to SecurityWeek’s August 22, 2019 report. | August 22, 2019, as reported by SecurityWeek. |
These are the vulnerabilities and dates described in the 2019 article; they do not establish whether a particular system was affected or compromised.
What did researchers observe?
Researcher Kevin Beaumont said he saw the attempts through BinaryEdge. SecurityWeek characterized the activity as scanning for vulnerable systems and cautioned that more malicious payloads could follow. The reporting did not confirm a successful compromise or identify a victim organization.
#1 Best Overall
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Fortinet is the most deployed and trusted firewall from businesses worldwide with 99.98% security effectiveness, surpassing competition. Fortinet is the only vendor recognized as a firewall leader 13 consecutive years by Gartner.
The activity followed research by Orange Tsai and Meh Chang of DEVCORE. In a July 25, 2019 background article, SecurityWeek said the researchers had identified seven vulnerabilities in Pulse Secure products and five in FortiGate SSL VPN. The article also reported that some flaws could be chained to achieve remote code execution, including two FortiGate flaws. Those counts and chaining observations describe the researchers’ 2019 findings; they are not current vulnerability totals or evidence that a chain was used in the observed scans.
When were fixes available?
Pulse Secure told SecurityWeek that it publicly provided a fix for Pulse Connect Secure on April 24, 2019, under Security Advisory SA44101, and had notified customers and service providers. The company said customers had been downloading and applying the patch, and that it was not aware of exploitation when it developed and released the fix. Fortinet’s updates for the discussed flaws were released in May 2019, according to SecurityWeek’s July background report.
Rank #2
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
Patch availability at that time does not show whether any individual appliance was updated. These historical articles do not establish current affected versions or the status of a particular deployment.
Quick Recap
Best Value
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Including award-winning FortiGate hardware and 1-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
Rank #3
- Built on a purposed-built secure processor, this compact network firewall delivers the highest level of security performance and energy efficiency in its class – 2.5 Gbps IPS throughput | 1.3 Gbps threat protection | 1.4 Gbps SSL Inspection throughput.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact design equipped with 10 x GE RJ45 ports (including 7 x Internal Ports, 2 x WAN Ports, 1 x DMZ Port) provide essential connectivity and flexibility for various network configurations in branch offices.
What should an administrator do now?
- Identify the exact VPN product and installed version in your environment.
- Check the vendor’s current official security advisory for that product and version, then apply the applicable supported fix. Do not rely on historical patch dates alone to determine whether a device is protected.
- If you suspect compromise, investigate relevant appliance and network logs and follow your organization’s incident-response process. The 2019 report of scanning does not by itself establish a breach.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
