Hard-Coded password in Fortinet Firewalls.

               Cyber security is considered to be a myth these days and whatever security implementation placed in place, attacker finds a way to exploit it. Recently a famous Firewall vendor solution found to have a hardcoded password.

                Firewall is the security component everyone came across while considering cyber securiy. What if it is having a backdoor to access with hardcoded password. Hardcoded passwords are nothing but Passwords embedded in the coding itself.

                Actually Hardcoded passwords are left by developer due to the laziness or negligence to make complex coding to generate password or to enforce any secure coding practices.

                 Famous Firewall solution provider #Fortinet is accused of having a hardcoded password which allows the SSH login for the user with username Fortimanager_Access and password : FGTAbc11*xy+Qqz27. This is the hardcoded password found in Fortinet.

               The exploit code has been released publicly and with that code the attacker can exploit the Management user account and will get access to the Firewall maintainence page.

               The whole exploit code for the vulnerability can be found here. This has been notified to Fortinet and they have fixed it anyhow the Fortinet Firewall manufactured between November 2012 and July 2014.

                If the firmware has not been upgraded by the user then there is a chance of the vulnerability exists still in the firmware and users are advised to upgrade the firmware to avoid any further damage.

P.S: The post is to create awareness and not to create any negative impact.