Daily Dose of Cybersecurity News - August 17, 2025
FortiWeb Authentication Bypass Vulnerability (CVE-2025-52970)
HighWhat happened
A security researcher disclosed a vulnerability in FortiWeb's cookie parsing mechanism, allowing remote attackers to bypass authentication by forging session cookies.
Who is affected
Organizations using FortiWeb versions 7.0 to 7.6 are impacted by this vulnerability.
Why it matters
Exploitation enables attackers to impersonate any active user, including administrators, potentially leading to unauthorized access and control over affected systems.
How it could have been prevented
Implementing strict input validation and proper handling of cookie parameters could have mitigated this vulnerability.
Relevant professional terms
- Out-of-Bounds Read
- An error condition where a program reads data past the end of an allocated buffer, potentially leading to unauthorized access to sensitive information.
- HMAC (Hash-based Message Authentication Code)
- A mechanism for calculating a message authentication code using a cryptographic hash function and a secret key, ensuring data integrity and authenticity.
Recommended reading: Fortinet PSIRT Blog on FortiWeb Authentication Bypass Vulnerability
ERMAC V3.0 Banking Trojan Source Code Leak Exposes Full Malware Infrastructure
HighWhat happened
Cybersecurity researchers have uncovered the complete source code of ERMAC 3.0, an Android banking trojan, revealing significant weaknesses in its infrastructure.
Who is affected
Users of over 700 banking, shopping, and cryptocurrency applications targeted by ERMAC 3.0.
Why it matters
The exposure of ERMAC 3.0's source code provides defenders with insights to track, detect, and disrupt active operations, potentially mitigating threats posed by this malware.
How it could have been prevented
Implementing robust security measures, such as regular code audits, secure coding practices, and timely patching of vulnerabilities, could have mitigated the risks associated with ERMAC 3.0.
Relevant professional terms
- Malware-as-a-Service (MaaS)
- A business model where malware developers offer their malicious software and services for rent or sale to other cybercriminals.
- Command-and-Control (C2) Server
- A server used by attackers to send commands to compromised systems and receive stolen data.
Recommended reading: Hook: New Android Banking Trojan That Expands on ERMAC's Legacy