CVE Vulnerability Advisory Database

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] Fortinet FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, and prior to 6.4.11

[Impact] A privileged attacker can read and write arbitrary files on the underlying Linux system via crafted CLI commands, potentially leading to firmware tampering and persistent backdoor installation

[Mitigation] Immediately upgrade to the official patched versions (7.2.4, 7.0.10, 6.4.11 or higher)

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] FortiOS (7.2.0 to 7.2.1, 7.0.0 to 7.0.6), FortiProxy (7.2.0, 7.0.0 to 7.0.6), FortiSwitchManager (7.2.0, 7.0.0)

[Impact] An unauthenticated remote attacker can bypass authentication via specially crafted HTTP/HTTPS requests, gaining full administrative access to perform arbitrary operations

[Mitigation] Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks

[Affected Scope] FortiOS versions prior to 7.0.3 utilizing the 'execute restore src-vis' command

[Impact] A local authenticated attacker can download arbitrary files onto the device via specially crafted update packages, compromising system integrity

[Mitigation] Immediately upgrade FortiOS to version 7.0.3 or higher, and restrict local administrator CLI privileges

[Affected Scope] FortiOS versions 6.2.0 and below, and 6.0.x branch prior to patched releases

[Impact] An unauthenticated attacker on the same subnet can intercept sensitive credentials by impersonating the legitimate LDAP server

[Mitigation] Upgrade FortiOS to the latest patched release or enforce LDAPS with strict certificate validation

[Affected Scope] SSL VPN service running on FortiOS 6.4.0, 6.2.0 to 6.2.3, and 6.0.9 and below

[Impact] Attackers can bypass the second-factor authentication (FortiToken) and gain unauthorized access to the internal network by altering the case of the username

[Mitigation] Immediately upgrade FortiOS to the patched versions (6.4.1, 6.2.4, 6.0.10 or higher) and audit SSL VPN access logs

[Affected Scope] FortiOS versions 6.0.4 and below, and 5.6.8 and below, when configuration backups are taken without a custom password

[Impact] An attacker with access to the backup file can decrypt sensitive data, including user passwords, private key passphrases, and High Availability (HA) passwords, using the hard-coded key

[Mitigation] Upgrade FortiOS to patched versions and enforce custom password encryption for all configuration backups

[Affected Scope] FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, and FortiProxy 1.0/1.1/1.2/2.0 series

[Impact] An unauthenticated remote attacker can modify the password of any SSL VPN web portal user via specially crafted HTTP requests, leading to unauthorized network access

[Mitigation] Immediately upgrade the firmware to the patched versions, or restrict/disable the SSL VPN web portal service as a temporary workaround

[Affected Scope] Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, 5.4.6 to 5.4.12, and specific FortiProxy versions with SSL VPN web portal enabled

[Impact] Unauthenticated remote attackers can download arbitrary system files (including active session credentials) via specially crafted HTTP requests, leading to full network compromise

[Mitigation] Immediately upgrade FortiOS/FortiProxy firmware to the patched versions, terminate active SSL VPN sessions, and enforce a global password reset

[Affected Scope] FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, and FortiProxy versions 2.0.0, 1.2.8 and earlier with SSL VPN web portal enabled

[Impact] Remote attackers can trigger a heap buffer overflow by forcing the proxy to process malicious javascript href data, leading to the termination of the SSL VPN web service and disconnection of active user sessions

[Mitigation] Immediately upgrade FortiOS and FortiProxy firmware to patched versions, or temporarily disable the SSL VPN web portal feature and restrict access to trusted source IPs

[Affected Scope] Enterprise network environments running FortiOS 6.0.2, 5.6.7 and before, or FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4

[Impact] An authenticated attacker can redirect LDAP connectivity test requests to a rogue LDAP server, exposing configured LDAP administrator credentials in plaintext or reversible format

[Mitigation] Upgrade FortiOS and FortiADC to the latest patched versions immediately and restrict administrative access using trusted host configurations