CVE report
CVE-2018-13379criticalKEV
Fortinet FortiOS - Credentials Disclosure
Events 90d
73
Distinct IPs
53
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2018-13379 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 11 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2018-13379
- 5.188.206.20213 eventsBulgaria· Krez 999 Eood
- 94.102.49.1255 eventsNetherlands· IP Volume inc
- 179.43.186.2394 eventsSwitzerland· Private Layer INC
- 207.154.208.2442 eventsGermany· DigitalOcean, LLC
- 66.228.53.1051 eventsUnited States
- 23.239.12.1291 eventsUnited States
- 74.207.243.861 eventsUnited States
- 159.65.226.1561 eventsUnited States
- 165.22.150.1721 eventsUnited States
- 147.182.179.261 eventsUnited States
- 167.99.151.1641 eventsUnited States
- 134.122.36.2551 eventsCanada
- 194.195.211.1991 eventsUnited States
- 139.177.205.431 eventsUnited States
- 170.64.146.1801 eventsAustralia
- 101.36.125.581 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 165.227.23.21 eventsUnited States
- 192.81.131.1401 eventsUnited States
- 159.89.55.591 eventsUnited States
- 165.227.21.391 eventsUnited States
- 74.207.252.1091 eventsUnited States
- 66.228.47.401 eventsUnited States
- 45.79.103.441 eventsUnited States
- 178.128.179.481 eventsUnited States
- 157.230.180.2261 eventsUnited States
- 134.209.56.51 eventsUnited States
- 45.79.207.141 eventsUnited States
- 23.239.12.2141 eventsUnited States
- 50.116.30.1891 eventsUnited States
- 167.172.121.2141 eventsUnited States
Top networks the attempts come from
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0500_2d30dc89d981ja4h: ge11nn0300_0db47b7d240dja4h: ge11nn0400_628fde536a8dja4h: ge11nn0400_8fd06a127c33ja4h: ge11nn07en_7cbe7c6c580dja4h: ge11nn0300_dedeb29cc523ja4: t13i3112h1_e8f1e7e78f70_d339722ba4afja4: t13i311000_e8f1e7e78f70_d41ae481755eja4: t13i190800_9dc949149365_97f8aa674fd9ja4: t13i140900_cbb2034c60b8_e7c285222651ja4: t13i911100_0d5420ba6086_87b33ccefea8
Sample request paths observed
- /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession