DEV Community

StarkMan
StarkMan

Posted on

How to read global FortiGate exposure counts without inventing risk rates

#fortinet #fortimanager #fortigate #incidentresponse

How to read global FortiGate exposure counts without inventing risk rates

ZoomEye returned 1,012,298 matches for app="FortiGate" on October 27, 2026. That is a useful population observation for an incident involving FortiManager and FortiGate. It is not a global risk score, a vulnerable-device count, or a forecast of how many organizations will be attacked.

The right reading starts with the denominator that the query did not provide.

What the count measures

The query used the all asset type and the FortiGate product fingerprint. ZoomEye reports the total matched population, not the number of records retrieved and not the number of unique organizations. A web service associated with a device, an address range, and other index records can have different ownership and deployment meanings.

The query was run on October 29 for four country samples with the same product filter. The stored observations are:

Sample scope Matches
United States 124,875
China 114,508
Germany 27,694
Japan 15,728

These illustrate that the observed product population is not concentrated in one sampled country. They are not a full ranking, because only four countries were measured. The total also does not equal the sum of countries, and one asset classification can change as banners, certificates, or index coverage change.

What the event adds

Unit 42 investigated a telecom managed service provider after attackers used CVE-2024-47575 against FortiManager. The attackers exported configuration material for more than 500 managed FortiGate firewalls. They later exploited CVE-2025-61624 to move from FortiOS administrative control to root and deploy PeerStitch, a memory-resident implant.

That narrative explains why edge appliances deserve scrutiny. It does not mean every observed FortiGate has the affected software. CVE-2025-61624 has release-specific affected ranges. CVE-2024-47575 concerns the FortiManager management path. A broad product query crosses both cases and may include devices outside either one.

Keep the method visible

An operational report should preserve the exact query, date, asset type, count, and subsequent owner validation. It should also show the limit that matters to the decision. For example:

ZoomEye matched 1,012,298 FortiGate product fingerprints on October 27, 2026. The owner must confirm which assets are internet-accessible management interfaces, which firmware versions are in use, and which management relationships are active.

That statement gives analysts a reproducible scope and gives decision makers a clear next action. A simpler statement such as "one million firewalls are at risk" drops the method and overstates the evidence.

Compare only comparable observations

The event's stored evidence also includes 1 match for app="FortiManager", 86 matches for port="541", and 0 matches for app="FortiGate" && port="541". These values describe different fields. Adding them would create a number with no meaning.

Use each result to formulate a question. Product matches ask whether the owner's inventory covers the relevant appliance. The TCP 541 result asks whether further protocol-aware validation is needed on each matched address. The combined zero asks why the indexed observations did not overlap, not whether FGFM disappeared.

Changes over time deserve the same caution. If the product count rises after a new scan, index coverage may have changed. A matching product may also have been upgraded. Stable counts can hide movement among assets. Treat each comparison as a new observation with its own timestamp.

Turn discovery into an owner task

ZoomEye can provide a broad candidate set and an external baseline. The owner should reconcile matches with DNS and cloud inventories, verify ownership, inspect the actual management interface, collect firmware evidence, and compare management enrollments against the approved inventory.

After those checks, a team can separate:

  • externally observed product assets;
  • internally confirmed FortiGate devices;
  • assets on a known affected release;
  • devices with evidence of suspicious management activity;
  • devices with confirmed exploitation.

That ladder is more useful than a single headline number. It also supports honest progress reporting after patching and trust rotation.

References

Top comments (0)