FG-IR-23-225: SSL-VPN user IP spoofing
An insufficient verification of data authenticity vulnerability [CWE-345] in FortiOS & FortiProxy SSL-VPN tunnel mode may allow an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-225?
The severity of FG-IR-23-225 is categorized as a high risk due to its potential to allow IP spoofing by authenticated VPN users.
How do I fix FG-IR-23-225?
To fix FG-IR-23-225, update FortiOS and FortiProxy to the recommended versions: FortiOS to 7.4.2, 7.2.8, or 7.0.13, depending on your current version.
Who is affected by FG-IR-23-225?
FG-IR-23-225 affects users of FortiOS and FortiProxy versions that are older than the specified remedial updates.
What types of products are impacted by FG-IR-23-225?
FG-IR-23-225 impacts FortiOS and FortiProxy products that fall within specific version ranges susceptible to the vulnerability.
Can an unauthenticated user exploit FG-IR-23-225?
No, FG-IR-23-225 requires an authenticated VPN user to exploit the vulnerability.