Clients with managed services are better prepared and protected.  At Intellect IT, we are dedicated to ensuring the security of our clients’ systems by proactively identifying and addressing potential threats. Recently, a critical vulnerability, FG-IR-24-535, was discovered in certain versions of FortiOS, a software used in some of our clients’ devices.

This vulnerability could potentially allow an attacker to compromise a device if they have access to the administrative interface, which is typically open to the Internet by default. However, this issue only affects older versions of FortiOS. Newer versions are not impacted.
To ensure the safety of our clients’ systems, we took two key measures:

1.      We verified that devices were running a non-vulnerable version of FortiOS.
2.      We confirmed that the administrative interface was not accessible from the Internet.

As of January 15, 2025, we found that a small minority of the FortiOS devices we manage were running a vulnerable version. However, none of these devices had their administrative interface open to the Internet as we had disabled this as part of Managed Services best practices. This conclusion was reached through a thorough manual check of each potentially vulnerable system as part of our BAU activities.  Additionally, these devices had already been scheduled for patching and were awaiting client approvals.

Based on this careful assessment, we downgraded the severity of this vulnerability from Critical to Low.  We have also initiated our standard process for upgrading systems running vulnerable versions of FortiOS.

At Intellect IT, we are committed to providing our clients with the highest level of security. Our proactive and meticulous approach ensures that we stay ahead of potential issues and maintain the integrity of our clients’ systems. We often perform such critical work behind the scenes, and we want to showcase the value we add to your organization’s ability to be successful. By keeping your systems secure and up-to-date, we help you focus on your core business activities without worrying about potential threats.