VPN Firewalls as Sitting Ducks?

A recent addition of a Fortinet vulnerability (CVE-2025-24472) to CISA's Known Exploited Vulnerabilities Catalog shows attackers are continuously exploring additional venues into Fortigate and FortiProxy devices, combining them with previously found ones (see details here).

As we can expect more such vulnerabilities to surface (from all vendors!), upgrading and ideally moving to autopatch or vendor managed infrastructure (SASE-like approach) should be a priority for organizations of all sizes.

A good starting point is enrolling devices into FortiGate Cloud, which leans towards more automated patching against exploited vulnerabilities (see a recent update here)

In any case, the threat actor activities are part of a larger pattern of reverse engineering internet-facing devices such NGFWs or VPN remote access gateways (see here), and Fortinet is particularly attractive due to its success as one of the market leaders.

🖼️ Picture: the number of public-facing devices in the Adriatics region according to Shodan internet search engine.

Fortigate devices in the Adriatic countries as retrieved via Shodan search engine