FORTINET▊
Organization dossier NASDAQ: FTNT Status: market leader
The company that sells the box guarding the perimeter shipped an undocumented SSH login with one password for every device, then a VPN that handed out its own users' passwords in plaintext to anyone who asked with the right slashes. Tens of thousands of those credentials ended up in a public dump. Nation-state advisories followed. Fortinet called the first one "a management authentication issue."
This was not a 'backdoor' vulnerability issue but rather a management authentication issue.
Fortinet, official blog post — "Brief Statement Regarding Issues Found with FortiOS," community.fortinet.com, January 13, 2016
After careful analysis and investigation, we were able to verify this issue was not due to any malicious activity by any party, internal or external.
Fortinet, same statement, per its company blog (Jan 2016)
- ENTITY
- Fortinet, Inc., Sunnyvale, California — NASDAQ: FTNT; maker of FortiOS, FortiGate, FortiProxy, FortiManager FACT
- PRODUCT LINE
- Enterprise firewalls and SSL-VPN gateways — the appliance that sits at the network edge and is supposed to keep the attackers out FACT
- THE DRAMA
- A hard-coded password one researcher pulled out of the firmware; ~87,000 devices' worth of VPN credentials dumped on a hacking forum; FBI/CISA joint advisories naming the boxes as APT and ransomware entry points; and a pattern of quiet patches critics call "silent"
- THE CHARACTERIZATION
- "Backdoor" is what researchers and the press called the 2016 SSH login; "management authentication issue" is what Fortinet called it. Both terms are on this page, each attributed to who said it. ATTRIBUTED
- STATUS
- STILL SHIPPING — Fortinet is one of the largest network-security vendors on earth; the CVEs are patched; the advisories say the exploited devices were largely unpatched
This is a company, not a person — and a security vendor is judged by a single, brutal standard: does the thing you sell to keep attackers out, keep attackers out. What follows is a decade of the edge device failing at exactly that, in order, with the mechanism of each failure spelled out — because the point is not that Fortinet had CVEs (everyone has CVEs) but how these particular doors opened.
Every beat below carries its receipt: an NVD record, a Fortinet PSIRT advisory, a CISA alert. Both sides get the microphone — and Fortinet's strongest card, that the carnage landed almost entirely on devices nobody bothered to patch, is real and stays on the page. You decide who wins.
the drama timeline
ACT I — THE UNDOCUMENTED LOGIN (2012–2016)
Every perimeter device needs a way for its manager to reach it. This is the story of what happens when that way is a single password baked into the firmware — the same one, on every box.
-
JAN 2016
The SSH login that wasn't in the manual
A researcher publishes exploit code for an undocumented administrative login in FortiOS. Fortinet's own advisory (FG-IR-16-001, CVE-2016-1909) confirms it: an account meant for FortiManager communication that "can be used to log in via SSH… using a password shared across all devices," granting "a CLI console with administrative rights." It affected FortiOS 4.3.0–4.3.16 and 5.0.0–5.0.7 — builds shipped between roughly 2012 and 2014. The press and researchers called it a backdoor; The Register ran it under that word.
A security appliance is one long argument that hard-coded, shared secrets are how attackers get in. This one shipped with a hard-coded, shared secret.
-
HOW IT WORKED
The mechanism: one hash, every device
The login used the fixed username Fortimanager_Access and a challenge-response routine keyed to a password string hard-coded into every FortiOS build in the affected range. Anyone who knew the string — and it was in the firmware, so anyone who looked did — could open an SSH session with full administrative CLI rights on any exposed, unpatched FortiGate. No per-device secret, no customer-set credential: the same key opened every lock in the product line.
-
JAN 2016
Fortinet answers: "management authentication issue"
Fortinet's public statement: this "was not a 'backdoor'… but rather a management authentication issue," an unintended consequence of a feature for seamless FortiManager-to-FortiGate access, and "not due to any malicious activity by any party, internal or external." The company says a fix had been shipped in later FortiOS builds. Its term and the researchers' term are both on the record; neither has been adjudicated.
ACT II — THE DOOR IN THE VPN (2018–2021)
The undocumented login was 2016's problem. The next one did not need a secret string at all — just a URL with enough ../ in it to walk out of the web root carrying other people's passwords.
-
2019
CVE-2018-13379: the path-traversal that read passwords
Fortinet patches (FG-IR-18-384, CVE-2018-13379) a path-traversal flaw in the FortiOS SSL-VPN web portal that let an unauthenticated attacker read arbitrary system files off the device. The fix ships in May 2019. The catch, established below, is how many customers never applied it.
-
HOW IT WORKED
The mechanism: ../ to the session file
An attacker requested a specially crafted URL against the SSL-VPN portal, using directory traversal to climb out of the intended web directory and read a file the portal was never meant to serve: sslvpn_websession. That file held active session data — including, for affected sessions, usernames and passwords in plaintext. No login required. Point the request at an exposed FortiGate, receive the credentials of people using it. The exploit was pre-authentication, reliable, and trivially scalable across the internet.
The device whose entire job is to authenticate remote users would, unpatched, read you the list of those users and their passwords first.
-
SEP 2021
~87,000 devices, dumped in public
A threat actor posts a list of SSL-VPN credentials harvested via CVE-2018-13379 from roughly 87,000 FortiGate devices — reported as nearly half a million credential pairs. Fortinet itself confirms it in a PSIRT blog, urging customers to patch and reset passwords. The same flaw was, by then, a known favorite: CISA and the FBI had already named CVE-2018-13379 among the Fortinet bugs that APT and ransomware operators used for initial access.
ACT III — THE HEADER AND THE HEAP (2022–2023)
Two more edge bugs, two more pre-authentication paths to administrator. One turned on a spoofed HTTP header; the other on a classic memory overflow. The second one Fortinet patched quietly — and that quiet is its own line item.
-
OCT 2022
CVE-2022-40684: become admin by forging a header
Fortinet discloses (FG-IR-22-377, CVE-2022-40684) a critical authentication bypass, CVSS 9.6, in FortiOS, FortiProxy and FortiSwitchManager. The mechanism: an unauthenticated attacker sends a crafted HTTP request that spoofs a trusted source — researchers documented setting the client address to 127.0.0.1 so the box believed the request came from itself — then operates the administrative interface directly, up to creating rogue super_admin accounts. Fortinet confirmed in-the-wild exploitation; researchers reported mass scanning and exploitation within days.
-
JUN 2023
CVE-2023-27997 (XORtigate): the quiet fix
Fortinet ships firmware fixes on June 9, 2023 for a pre-authentication heap buffer overflow in the SSL-VPN (FG-IR-23-097, CVE-2023-27997, nicknamed "XORtigate") — a memory-corruption bug reachable without credentials, allowing remote code execution and bypassing MFA. The public advisory came four days later, on June 13. Researchers noted the fix landed in the code before the advisory landed for customers — the pattern critics call silent patching: shipping the repair quietly, so only those watching the diffs know to hurry. Fortinet later acknowledged the flaw had been exploited in a limited number of cases.
A patch nobody is told about protects the attackers who reverse-engineer it faster than the customers who don't.
ACT IV — THE LEDGER (2021–PRESENT)
When the same vendor's edge devices keep turning up as the door, the governments whose networks sit behind them start writing it down. Here is the official ledger — and here is Fortinet's answer, at full strength.
-
2021→
The advisories name the boxes
The FBI and CISA issue a joint advisory (April 2021) that APT actors are exploiting FortiOS vulnerabilities — including CVE-2018-13379 — to gain initial access, followed by an FBI update in May. A November 2021 joint alert (AA21-321A) names Iranian government-sponsored actors exploiting Fortinet and Exchange flaws. Multiple Fortinet CVEs sit in CISA's Known Exploited Vulnerabilities catalog — the government's list of bugs confirmed used in real attacks.
-
EPILOGUE
Still the market leader
Every CVE above is patched. Fortinet runs a public PSIRT, assigns CVEs, and participates in the KEV process. It remains one of the largest security vendors in the world, and its own advisories — and the CISA alerts — stress that the exploited devices were, overwhelmingly, ones nobody had updated. The archive keeps the CVE list open.
both sides, on the record
The vulnerabilities are documented, not alleged: an undocumented SSH login with a shared, hard-coded password across the product line (CVE-2016-1909); an unauthenticated SSL-VPN path traversal that read plaintext session credentials (CVE-2018-13379); a CVSS-9.6 authentication bypass via a spoofed request (CVE-2022-40684); and a pre-auth heap overflow reachable without credentials (CVE-2023-27997) [1] [3] [5] [6].
The consequences are on the record: ~87,000 devices' worth of VPN credentials dumped publicly and confirmed by Fortinet itself; multiple FBI/CISA advisories naming the boxes as APT and ransomware entry points; several Fortinet CVEs in the government's Known Exploited Vulnerabilities catalog [10] [7] [9].
The disclosure critique (the researchers', attributed): CVE-2023-27997 was patched in code four days before any advisory reached customers — the "silent patching" pattern, in which the fix protects whoever reverse-engineers it first [12].
Fortinet's position, in its own words: the 2016 SSH issue was "not a 'backdoor'… but rather a management authentication issue," an artifact of a FortiManager access feature, "not due to any malicious activity by any party," and remediated [2]. The company runs a public PSIRT, assigns CVEs, publishes advisories, and takes part in the coordinated-disclosure and KEV processes [10] [9].
Its strongest card is real: the mass exploitation — the 2021 credential dump above all — hit devices that were unpatched, end-of-life, or misconfigured, where the fix had shipped long before. CVE-2018-13379 was patched in May 2019; the public dump came in September 2021, more than two years later. Fortinet and CISA both framed the failure as one of patching, not of an unfixed hole [10] [7].
Scope of the record: every major network-security vendor carries serious CVEs; a bug count is not, by itself, a verdict. No court or regulator has adjudicated any of this. "Backdoor" is a characterization; Fortinet's "management authentication issue" is its own, and both stand on this page. No motive is asserted [2] [4].
YOU DECIDE
Scoped to the claims, never to intent. The claim "these were serious, exploitable flaws in a device sold to keep attackers out" is not in dispute: the CVEs, the CVSS scores, the plaintext-credential mechanism, and the government advisories are all primary-sourced above. The claim "this was a deliberate backdoor" is not established — it is a characterization researchers used and Fortinet rejected as a "management authentication issue," and no adjudication exists either way. That distinction stays sharp here.
Weigh the costly signals. Fortinet's best defense — that the victims were unpatched — is true and it is also the whole indictment of the edge-appliance model: a single vendor's box, exposed to the internet by design, that stays vulnerable for years because patching a firewall means downtime nobody schedules. The mechanism didn't need a genius. CVE-2018-13379 needed some ../. CVE-2022-40684 needed a forged header. The one thing that would have closed each door — applying the patch Fortinet shipped — was, for tens of thousands of operators, apparently the hardest ask in security.
The archive does not judge. The archive merely keeps the CVE list open.
evidence locker
PRIMARY RECORD — CVEs & VENDOR ADVISORIES
NVD — CVE-2022-40684 + Fortinet PSIRT FG-IR-22-377 (auth bypass, CVSS 9.6) FACT — the administrative-interface authentication bypass.
fortiguard.com/psirt/FG-IR-22-377
GOVERNMENT RECORD — CISA / FBI
PRESS & RESEARCH
The Register — "Fortinet tries to explain weird SSH 'backdoor'" (Jan 2016) ATTRIBUTED — the "backdoor" characterization and the contemporaneous reporting. (Live; may 403 automated fetchers.)
theregister.com/2016/01/12/fortinet_bakdoor/
The standard. Everything above is sourced to the National Vulnerability Database, Fortinet's own PSIRT advisories and blog posts, CISA and FBI advisories, and named security-research and press reporting. CVEs, CVSS scores, exploitation confirmations, and the credential dump are stated as facts and carry primary receipts. "Backdoor" is stated as a characterization and wears the researchers and outlets who used it; Fortinet's "management authentication issue" is quoted verbatim from Fortinet and stands at full strength beside it. The defense — that the exploited devices were overwhelmingly unpatched, that every major vendor carries CVEs, and that Fortinet participates in coordinated disclosure — is presented without trimming. No motive is asserted, no deliberate backdoor is alleged, no individual is named. The burden of proof is on us, not the subject. If it couldn't survive a defamation challenge, it wouldn't be on this page.