Fortinet Zero-Day Used to Exfiltrate Firewall Configs, Now Leaked

A massive trove of firewall configuration files exfiltrated from Fortinet FortiGate devices has surfaced publicly, likely stolen via CVE-2022-42475, a zero-day previously linked to Chinese APTs. The leak, dubbed Fortigate-Belsen, includes over 23,000 device configs from organizations worldwide, exposing internal network structures, VPN users, hashes, and policies. The attackers exploited a flaw in SSL-VPN components before Fortinet fully patched it in early 2023. A list of affected IPs contains 15000 entries. Fortinet’s own analysis points to a different door: the admin-interface authentication bypass CVE-2022-40684, with the data collected before November 2022, so devices that have only ever run FortiOS 7.2.2 or later are not affected. Anyone who ran an affected version back then and skipped the cleanup should still review credentials, because old loot is still loot.