CVE Vulnerability Advisory Database

[Affected Scope] Major Fortinet solutions including FortiOS (6.4-7.6), FortiPAM (1.0-1.7), FortiProxy (7.0-7.6), and FortiSwitchManager (7.0-7.2).

[Impact] Authenticated attackers with administrative privileges can write or delete arbitrary system files via specific CLI commands, leading to system compromise or persistence.

[Mitigation] Immediately upgrade to the latest patched firmware versions and strictly enforce IP-based access control for administrative CLI access.

[Affected Scope] Fortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4

[Impact] A remote unauthenticated attacker with prior filesystem-level access can bypass existing symbolic link persistency mitigations via crafted HTTP requests to expose sensitive information

[Mitigation] Immediately upgrade to the patched firmware versions recommended in the official Fortinet advisory (FG-IR-25-934)

[Affected Scope] FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, and FortiNAC-F devices with FortiCloud SSO authentication enabled

[Impact] An attacker with a valid FortiCloud account and a registered device can bypass authentication to log into other registered devices under different accounts, gaining full administrative control (CVSS 9.8, Active KEV)

[Mitigation] Immediately upgrade to the patched firmware versions or disable FortiCloud SSO administrator login on all affected devices

[Affected Scope] FortiOS versions 6.4 through 7.6 and FortiSwitchManager versions 7.0 through 7.2.

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands with system privileges by sending crafted packets, leading to full system compromise.

[Mitigation] Immediately apply the latest firmware updates provided by Fortinet and restrict exposure of management interfaces and VPN services to the public internet.

[Affected Scope] FortiOS 7.0.0-7.0.17 / 7.2.0-7.2.11 / 7.4.0-7.4.8 / 7.6.0-7.6.3, FortiProxy 7.0.0-7.0.21 / 7.2.0-7.2.14 / 7.4.0-7.4.10 / 7.6.0-7.6.3, FortiSwitchManager 7.0.0-7.0.5 / 7.2.0-7.2.6.

[Impact] An unauthenticated remote attacker can bypass FortiCloud SSO authentication via a crafted SAML response message, gaining full administrative access to the affected device.

[Mitigation] Immediately upgrade to the patched firmware versions, or disable FortiCloud SSO login and restrict administrative access to trusted IP addresses as a temporary workaround.

[Affected Scope] FortiOS versions 7.0.0 through 7.0.16, and FortiProxy versions 7.0.0 through 7.0.19, 7.2.0 through 7.2.12, with Security Fabric (CSF) enabled

[Impact] A remote unauthenticated attacker with knowledge of upstream and downstream device serial numbers can bypass authentication via crafted CSF proxy requests to gain full super-admin privileges on the downstream device

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the Security Fabric feature and restrict access to the CSF port as a temporary workaround

[Affected Scope] FortiOS versions 7.0.0 through 7.0.16, and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12

[Impact] Remote unauthenticated attackers can bypass authentication via crafted requests to the Node.js websocket module, gaining full super-admin privileges

[Mitigation] Immediately upgrade to the patched firmware versions and restrict external access to the management interface

[Affected Scope] FortiOS (7.0.0~7.0.13, 7.2.0~7.2.6, 7.4.0~7.4.2), FortiProxy (7.0.0~7.0.14, 7.2.0~7.2.8, 7.4.0~7.4.2), FortiPAM, and FortiSwitchManager specific versions

[Impact] Unauthenticated remote attackers can execute unauthorized code or commands with root privileges via specially crafted packets

[Mitigation] Upgrade to the official patched versions immediately, or disable the FGFM (FortiGate Federation Management) service on interfaces as a temporary workaround

[Affected Scope] FortiOS versions 6.0 through 7.4.2 and FortiProxy versions 1.0 through 7.4.2 with SSL-VPN service enabled

[Impact] Unauthenticated remote attackers can execute arbitrary code or commands on the target system via specially crafted HTTP requests

[Mitigation] Immediately upgrade to the patched firmware versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] FortiOS versions 7.2.4 and below, 7.0.11 and below, 6.4.12 and below, 6.0.16 and below; FortiProxy versions 7.2.3 and below, 7.0.9 and below, 2.0.12 and below, and all 1.2/1.1 versions with SSL-VPN enabled

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target appliance via specifically crafted HTTP requests

[Mitigation] Immediately upgrade FortiOS and FortiProxy to the patched versions, or disable the SSL-VPN service as a temporary workaround

[Affected Scope] Fortinet FortiOS versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, and prior to 6.4.11

[Impact] A privileged attacker can read and write arbitrary files on the underlying Linux system via crafted CLI commands, potentially leading to firmware tampering and persistent backdoor installation

[Mitigation] Immediately upgrade to the official patched versions (7.2.4, 7.0.10, 6.4.11 or higher)

[Affected Scope] FortiOS versions 7.2.0 to 7.2.2, 7.0.0 to 7.0.8, 6.4.0 to 6.4.10, 6.2.0 to 6.2.11, 6.0.15 and earlier; FortiProxy versions 7.2.0 to 7.2.1, 7.0.7 and earlier

[Impact] An unauthenticated remote attacker can execute arbitrary code or commands with root privileges on the target system by sending specifically crafted HTTP/HTTPS requests

[Mitigation] Immediately upgrade to the patched firmware versions or disable the SSL-VPN service and restrict access using local-in policies if patching is delayed

[Affected Scope] FortiOS (7.2.0 to 7.2.1, 7.0.0 to 7.0.6), FortiProxy (7.2.0, 7.0.0 to 7.0.6), FortiSwitchManager (7.2.0, 7.0.0)

[Impact] An unauthenticated remote attacker can bypass authentication via specially crafted HTTP/HTTPS requests, gaining full administrative access to perform arbitrary operations

[Mitigation] Immediately upgrade to patched versions (FortiOS 7.2.2 / 7.0.7 or higher) or disable HTTP/HTTPS administrative access from untrusted networks

[Affected Scope] FortiOS versions prior to 7.0.3 utilizing the 'execute restore src-vis' command

[Impact] A local authenticated attacker can download arbitrary files onto the device via specially crafted update packages, compromising system integrity

[Mitigation] Immediately upgrade FortiOS to version 7.0.3 or higher, and restrict local administrator CLI privileges

[Affected Scope] FortiOS versions 6.2.0 and below, and 6.0.x branch prior to patched releases

[Impact] An unauthenticated attacker on the same subnet can intercept sensitive credentials by impersonating the legitimate LDAP server

[Mitigation] Upgrade FortiOS to the latest patched release or enforce LDAPS with strict certificate validation

[Affected Scope] SSL VPN service running on FortiOS 6.4.0, 6.2.0 to 6.2.3, and 6.0.9 and below

[Impact] Attackers can bypass the second-factor authentication (FortiToken) and gain unauthorized access to the internal network by altering the case of the username

[Mitigation] Immediately upgrade FortiOS to the patched versions (6.4.1, 6.2.4, 6.0.10 or higher) and audit SSL VPN access logs

[Affected Scope] FortiOS versions 6.0.4 and below, and 5.6.8 and below, when configuration backups are taken without a custom password

[Impact] An attacker with access to the backup file can decrypt sensitive data, including user passwords, private key passphrases, and High Availability (HA) passwords, using the hard-coded key

[Mitigation] Upgrade FortiOS to patched versions and enforce custom password encryption for all configuration backups

[Affected Scope] FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8, 5.4.1 to 5.4.10, and FortiProxy 1.0/1.1/1.2/2.0 series

[Impact] An unauthenticated remote attacker can modify the password of any SSL VPN web portal user via specially crafted HTTP requests, leading to unauthorized network access

[Mitigation] Immediately upgrade the firmware to the patched versions, or restrict/disable the SSL VPN web portal service as a temporary workaround

[Affected Scope] Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7, 5.4.6 to 5.4.12, and specific FortiProxy versions with SSL VPN web portal enabled

[Impact] Unauthenticated remote attackers can download arbitrary system files (including active session credentials) via specially crafted HTTP requests, leading to full network compromise

[Mitigation] Immediately upgrade FortiOS/FortiProxy firmware to the patched versions, terminate active SSL VPN sessions, and enforce a global password reset

[Affected Scope] FortiOS versions 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier, and FortiProxy versions 2.0.0, 1.2.8 and earlier with SSL VPN web portal enabled

[Impact] Remote attackers can trigger a heap buffer overflow by forcing the proxy to process malicious javascript href data, leading to the termination of the SSL VPN web service and disconnection of active user sessions

[Mitigation] Immediately upgrade FortiOS and FortiProxy firmware to patched versions, or temporarily disable the SSL VPN web portal feature and restrict access to trusted source IPs