Fortinet FortiGate devices fall victim to automated attacks that create malicious accounts and steal firewall data

• Hackers exploit Fortinet FortiGate SSO bug to steal firewall configuration data
• FortiOS 7.4.10 patch is incomplete; new versions planned to completely fix the vulnerability
• Stolen firewall data exposes network topology, VPNs and security rules for new attacks

Cybercriminals appear to be taking advantage of a flaw in a recent patch for Fortinet FortiGate instances and are exploiting the vulnerability to create administrator accounts and steal firewall configuration data.

Security researchers at Arctic Wolf said they have seen hackers exploit a bug in the single sign-on (SSO) feature to create accounts and export firewall configurations, likely via an automated script.