FG-IR-23-301: Fortilink lack of certificate validation
An improper certificate validation vulnerability [CWE-295] in FortiOS may allow an unauthenticated attacker in a Man-in-the-Middle position to decipher and alter the FortiLink communication channel between the FortiOS device and a FortiSwitch instance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-23-301?
The severity of FG-IR-23-301 is considered critical due to the potential for unauthenticated attackers to exploit the vulnerability.
How do I fix FG-IR-23-301?
To fix FG-IR-23-301, upgrade FortiOS to version 7.4.2 or later, or to version 7.2.7 or later.
Which versions of FortiOS are affected by FG-IR-23-301?
FG-IR-23-301 affects FortiOS versions from 7.4.0 to 7.4.1, from 7.2.0 to 7.2.6, and all versions up to 7.0.15 and 6.4.
Can FG-IR-23-301 be exploited remotely?
Yes, FG-IR-23-301 can be exploited remotely by an attacker positioned in a Man-in-the-Middle scenario.
What type of vulnerability is FG-IR-23-301?
FG-IR-23-301 is categorized as an improper certificate validation vulnerability, listed under CWE-295.