Fortinet Learns Authentication Is Hard

Fortinet has delightfully graced us with yet another emergency update after discovering authentication in FortiWeb and FortiManager was practically decorative. Any uninvited guest could log in using random usernames and passwords or casually impersonate a FortiGate appliance without breaking a sweat. Enterprise network administrators who foolishly trusted these perimeter devices must now drop everything to deploy these patches before attackers inevitably walk right through the front door. Guarding ourselves from this enterprise comedy requires immediate patching, though we all know the next flaw is already waiting.