Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools
Dec 20, 2024
Vulnerability / Cyber Attack
A now-patched critical security flaw impacting Fortinet FortiClient EMS is being exploited by malicious actors as part of a cyber campaign that installed remote desktop software such as AnyDesk and ScreenConnect. The vulnerability in question is CVE-2023-48788 (CVSS score: 9.3), an SQL injection bug that allows attackers to execute unauthorized code or commands by sending specially crafted data packets. Russian cybersecurity firm Kaspersky said the October 2024 attack targeted an unnamed company's Windows server that was exposed to the internet and had two open ports associated with FortiClient EMS. "The targeted company employs this technology to allow employees to download specific policies to their corporate devices, granting them secure access to the Fortinet VPN," it said in a Thursday analysis. Further analysis of the incident found that the threat actors took advantage of CVE-2023-48788 as an initial access vector, subsequently dropping a ScreenConnect exe...
![⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [6 Jan]](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKokWQpcRQ55ARtaBLhn4X9RCRcf5u5YW7JaJaQrIrcU6A96dBP2IS5th1jhuZX0cQMO04KAMOZDxqEIcPdkAqGmkXMpHzV7L_CECca3FJ_ppgWQh9J0y8D02mSQbw-nzuf-FzDIN412s_F2AO-MGpfr95e-yMTzPjQqkl-WKo8jY1o6XMVvnF7bEmngEk/w72-h72-p-k-no-nu/recap.png "⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [6 Jan]")
