Tuesday , March 11 2025
Fortinet

Forescout Research
“Connect:fun” a campaign targeting FortiClient EMS via CVE-2023-48788

Utilizing Fortinet’s FortiClient EMS a news campaign has emerged. According to Vedere labs of forescout’s report this campaign leverages a critical vulnerability identified as CVE-2023-48788 and The campaign has been active since at least 2022 as stated the report.

CVE-2023-48788:

CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV

CISA included three vulnerabilities in Ivanti Endpoint Manager—CVE-2024-13159, CVE-2024-13160, and CVE-2024-13161—in its Known Exploited Vulnerabilities catalog. Federal agencies must address...
Read More
CISA Adds 3 Ivanti Endpoint Manager Bugs to KEV

Ransomware Attacks Set Records in February: New Data Shows

Ransomware attacks reached a record high in February, surpassing previous months, according to a Cyble report. The Cyble report tracked...
Read More
Ransomware Attacks Set Records in February: New Data Shows

Cyber attack at Japanese telecom leader NTT hits 18,000 companies

NTT Communications Corporation discovered illegal access to its facilities on February 5 and confirmed on February 6 that some information...
Read More
Cyber attack at Japanese telecom leader NTT hits 18,000 companies

Cyber heist: Pune losses Rs 6007 crore in cyber scam

India's Maharashtra Deputy Chief Minister Devendra Fadnavis disclosed alarming cyber fraud figures for Pune in 2024 during the Assembly session....
Read More
Cyber heist: Pune losses Rs 6007 crore in cyber scam

Nearly 1 million airport lost and found records leaked

Cybersecurity researcher Jeremiah Fowler found that over a dozen unprotected databases from the German firm Lost and Found Software exposed...
Read More
Nearly 1 million airport lost and found records leaked

Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike

Cisco Talos found that an unknown attacker has been targeting organizations in Japan since January 2025. The attacker exploited the...
Read More
Exploiting CVE-2024-4577, Attackers Target Japan with Cobalt Strike

Sleeping Beauty
Researchers Bypassed CrowdStrike Falcon Sensor partially

SEC Consult researchers found a vulnerability in CrowdStrike's Falcon Sensor, enabling attackers to evade detection and run malicious applications. The...
Read More
Sleeping Beauty  Researchers Bypassed CrowdStrike Falcon Sensor partially

CVE-2025-22224
41,500+ VMware ESXi Instances Vulnerable to Attacks

As of March 4, 2025, Shadowserver found that over 41,500 internet-exposed VMware ESXi hypervisors are vulnerable to the actively exploited...
Read More
CVE-2025-22224  41,500+ VMware ESXi Instances Vulnerable to Attacks

Register Now
AI Engineering Hackathon: Registration Open

On April 19, 2025 (Saturday), Brain Station 23 and Poridhi are jointly going to organize "AI ENGINEERING HACKATHON". The prize...
Read More
Register Now  AI Engineering Hackathon: Registration Open

Cisco alerts about a Webex flaw that exposes credentials

Cisco has alerted customers about a vulnerability in Webex for BroadWorks that could allow unauthorized attackers to access credentials remotely....
Read More
Cisco alerts about a Webex flaw that exposes credentials

According to the official documentation, FortiClient Enterprise Management Server (EMS) is a “security management solution that enables scalable and centralized management of multiple endpoints.”

    Source: Forescout

On March 12, Fortinet published an advisory about CVE-2023-48788, a SQL injection vulnerability in the Data Access Server (DAS) component of EMS which translates requests received by the FcmDaemon, the main application of EMS listening on port 8013, into SQL and interacts with the Microsoft SQL Server database which is part of the EMS installation.

The advisory states that unauthenticated attackers can achieve Remote Code Execution (RCE) via an SQL injection and scores the CVE as critical (CVSS score 9.8). The advisory also mentioned that this vulnerability was exploited in the wild and that Fortinet released a virtual patch named FG-VD54509 0day :FortiClientEMS.DAS.SQL. Injection ” to fix the issue.

On March 21, researchers released a proof of concept (PoC) exploit for CVE-2023-48788 and detailed that its root cause was missing sanitization of the FCTUID parameter. The vulnerability can be exploited by appending an SQL statement – such as the traditional “’ OR 1=1 –” test – to FCTUID in a request to FcmDaemon. Different effects can be obtained by changing the appended SQL statement. Full RCE can be achieved, for example, by enabling the xp_cmdshell stored procedure on the SQL server that EMS uses which spawns a Windows command shell and executes a string passed by the attacked.

  Source: Forescout

The Connect:fun campaign is particularly notable for its use of ScreenConnect and Powerfun as post-exploitation tools, marking it as Vedere Labs’ first-ever named campaign.

The incident that brought this campaign to light involved a media company whose FortiClient EMS was vulnerable and exposed to the internet.

The attack was not an isolated event. Scanning activity from the IP address 185[.]56[.]83[.]82 was observed targeting FortiClient EMS across various customer networks.

This activity began on March 21 and persisted through several days, indicating a concerted effort by the attackers to exploit the vulnerability across multiple potential victims.

The exploitation of CVE-2023-48788 poses a significant threat to organizations, as it can lead to unauthorized access and control over the FortiClient EMS.

This control can result in further malicious activities, including data theft, lateral movement within the network, and potentially a full-scale breach of the organization’s cyber defenses.

Mitigation recommendations, TTPs and IoCs:

To mitigate against exploitation of CVE-2023-48788, follow these steps:

• Apply the patch provided by Fortinet.
• Ensure that the traffic reaching FortiClient EMS is constantly monitored for signs of exploitation by using
an intrusion detection systems (IDS).
• Consider using a web application firewall (WAF) to block potentially malicious requests.
• Use the IoCs and TTPs shared below for threat detection and hunting in your network.

Source: Forescout, gbhackers

Check Also

CYFIRMA

FinStealer Malware Targets Indian Bank’s Mobile Users, Stealing Credentials

CYFIRMA analysis reveals a sophisticated malware campaign that exploits a major Indian bank’s brand through …

Leave a Reply

Your email address will not be published. Required fields are marked *