CVE-2018-13379: Fortinet FortiOS SSL VPN path traversal
HoneyLabs honeypots recorded 11 probes matching CVE-2018-13379 from 6 distinct source IP addresses in the last 7 days, of which 8 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.
4 sources probed for CVE-2018-13379 on the interactive sensors, and all of them sent the exploit payload.
Request paths that identify it
- /remote/fgt_lang
- /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 94.102.49.125 | 4 | IP Volume inc | The Netherlands |
| 45.61.188.204 | 2 | FranTech Solutions | United States |
| 88.216.68.224 | 2 | UAB Cherry Servers | United States |
| 5.138.251.156 | 1 | Rostelecom | Russia |
| 50.116.44.24 | 1 | Akamai Connected Cloud · commercial scanner: BinaryEdge | United States |
| 92.118.232.133 | 1 | Local NCC Ltd. | Cyprus |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS202425 | IP Volume inc | 4 | 1 |
| AS204770 | UAB Cherry Servers | 2 | 1 |
| AS53667 | FranTech Solutions | 2 | 1 |
| AS12389 | Rostelecom | 1 | 1 |
| AS212171 | Local NCC Ltd. | 1 | 1 |
| AS63949 | Akamai Connected Cloud | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| United States | 5 |
| The Netherlands | 4 |
| Cyprus | 1 |
| Russia | 1 |
Captured requests
- /remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession
Requests the interactive sensors answered
- GET /remote/fgt_lang
HTTP client fingerprints
- b11cun050_00040017_976354f0
- b11cun070_0004003f_176ad6eb
- b11cun030_00040012_f6d8d797
- b11cun040_00040013_608dab68
CVE report
CVE report
Open a specific CVE from the CVE tracker.