ACSC's Fortinet credential advisory leaves teams sizing exposure from internet scan counts

A stolen password has no version number. The ACSC describes a campaign "largely utilising exposed credentials and credential-based attacks, leading to potential compromise and further credential exposure" ^[2]. The gateway accepts a valid login, and the account then does whatever its role allows. The gateway, in that sense, is working as designed. The advisory's stated risk is remote access to the devices and connected networks, plus changes to settings "including security controls" ^[7]. A dev.to post proposing a way to count the exposed population argues that the population is defined by exposure and credential hygiene, not by a firmware range ^[4]. I agree. A scanner that matches banners against a CVE feed has nothing to match here ^[3].

The post's fallback is internet scan data. According to the post, a ZoomEye query for app="FortiGate" returned 983,996 assets on 23 September 2026 ^[8]. The author labels these internet-observable assets and says they are not counts of compromised devices, vulnerable devices or victims ^[10]. For the figure to apply to a given organisation, ZoomEye's crawler has to have reached that organisation's gateways and the fingerprint has to match them. The post notes that a banner string can be spoofed, a management page proxied and a hostname reused ^[16].

I part with the author on the certificate filter. The post argues that a second, independently collected indicator can corroborate the first or show that it is over- or under-counting ^[11]. The second query was app="FortiGate" && ssl.cert.pubkey.rsa.bits=2048, and it returned 254,801 ^[9]. That query is the first one with a condition added, so its results are a subset of the first ^[17]. Nothing in it can surface a FortiGate the fingerprint missed. All it can do is split the fingerprint's results: 25.9 percent of the 983,996 matched the 2048-bit condition and the other 729,195 did not ^[13][15]. To use that split as a check on false positives, you would need to know what share of genuine FortiGates present a 2048-bit RSA key. The post does not supply that baseline, and it describes the key size as common and not by itself a weakness ^[10].

Timing limits the count as well. The queries ran 97 days after the ACSC published ^[14]. They describe the gateways ZoomEye could see in late September.

Exposure in the advisory's sense is measured by its own mitigation list, run against each organisation's own configuration ^[5]. One item has a detail that is easy to miss. The advisory says to store credentials with PBKDF2 hashing and to log back in to admin accounts after updating so the encryption changes to PBKDF2 ^[6]. I'd expect the reason is that a device can rehash a password only when it sees the plaintext at login, so a dormant admin account would keep its old format.