fortigate-tech-support user

Ok,

according to this it is exactly the CVE problem - https://www.fortiguard.com/psirt/FG-IR-22-377

What are the best practices for this (other than upgrading to a patched version)?
Besides the user "fortigate-tech-support" that I deleted, is there anything else to watch out for? I checked the configuration several times (using PSpad) and found nothing out of the ordinary.

Thank you.

And one more question: the passwords are encrypted in the configuration file. If someone downloads the configuration file, is it possible to decrypt these passwords?

Greetings,

I would strongly recommend opening a case with TAC to take further steps.

Ahmad

Thanks,

ticket created.

J.

Same thing happend on my firewall also, anything suspicious..

Hi @Amar1 ,

Is this legitimate? I am seeing the same issue as well.

@Jirka1please advise on the feedback from support if you reported ? i also experienced the same thing on the same date as you

Noticed these on some Fortigates as well, what was the feedback and recommendation from Fortinet to take on this?

Based on the information provided, the unexpected reboot of your FortiGate device and the existence of an unknown user "fortigate-tech-support" in the Administrator section raise several important points and potential concerns:

1. Unscheduled Firmware Upgrade: The reboot appears to have been triggered by a firmware upgrade (from version 7.2.1 to 7.2.2), which may indicate an automated update process, possibly managed through FortiCloud or a scheduled task. Normally, these updates should be controlled and approved by an authorized administrator, and any deviation from this process should be investigated.

2. Unrecognized User Account: The creation of a new user account "fortigate-tech-support" without your knowledge is a significant concern. It may indicate unauthorized access to your device, a potential security breach, or a misconfiguration issue.

3. FortiCloud Integration: Since the FortiGate device is integrated with FortiCloud, it's possible that Fortinet technical support may have access to the device for support purposes. However, this should be done only with explicit authorization and proper security measures in place.

4. Security Vulnerabilities (CVE): The mention of a potential CVE (Common Vulnerabilities and Exposures) may suggest that there was a known security flaw in the firmware version 7.2.1 that required patching. It's important to review the release notes and here is security advisories for the new firmware version (7.2.2) to understand if there was a known vulnerability being addressed.