This is a documented feature of the FortiGate and FortiLog devices. You must have a local serial connection. So, this is not remotely exploitble. If someone has physical access to your firewall to make a serial connection, then you have plenty of other problems too. For reference: http://kc.forticare.com/default.asp?SID=&Lang=1&id=407 http://kc.forticare.com/default.asp?id=837&Lang=1 Mike Quoting Johan Andersson <andersson@xxxxxx>: > If you have console access to this box, you are able to get root access > or more by using the Username: maintainer > Password: pbcpbn[here should you type the serialnr. of the box, the > characters should be in Capital letters.] > FortiOS: 2.x > > Regards > Johan Andersson > Atea Security, Sweden > Phone: +46-709-19 71 76 > Mail: johan.andersson@xxxxxxxx > -- ************************************************************ Michael J. McCafferty Principal, Security Engineer M5 Hosting 858-576-7325 Voice http://www.m5hosting.com ************************************************************ ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.