FG-IR-25-667: Request smuggling attack in FortiOS
An HTTP request smuggling vulnerability [CWE-444] in FortiOS may allow an unauthenticated attacker to smuggle an unlogged http request through the firewall policies via a specially crafted header
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-25-667?
The FG-IR-25-667 vulnerability is considered critical due to its potential for unauthorized access and data compromise.
How do I fix FG-IR-25-667?
To mitigate the FG-IR-25-667 vulnerability, update FortiOS to versions 7.6.1 or 7.4.10 and above, or apply vendor patches as recommended.
What types of attackers can exploit FG-IR-25-667?
FG-IR-25-667 can be exploited by unauthenticated attackers who can craft malicious HTTP requests.
Which FortiOS versions are affected by FG-IR-25-667?
FG-IR-25-667 affects multiple FortiOS versions including 7.0, 7.2, and 6.4.3 to 6.4.16.
Is there a known workaround for FG-IR-25-667?
Currently, there are no specific workarounds for FG-IR-25-667 other than upgrading to a patched version of FortiOS.