Recently modified medium severity vulnerabilities for "fortinet fortios" 7.2.0

Where

AND

Sort:

Fortinet FortiProxyBuffer overread in authd and wad daemon

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to information disclosure via <insert attack vector here>

First published (updated )

CVE-2026-59840

Fortinet FortiProxyStack Buffer Overflow in Log Report

Risk 61

Severity

6.6

Buffer Overflow

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiPAM 1.8.0 through 1.8.2, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.13, FortiProxy 7.2 all versions may allow a privileged authenticated attacker who can bypass stack protection and ASLR to execute arbitrary code or commands via crafted HTTP requests.

First published (updated )

CVE-2026-59837

Fortinet FortiProxySSL-VPN Reflected XSS

Risk 38

Severity

6.1

XSS

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests.

First published (updated )

CVE-2026-23573

Fortinet FortiProxyHeader injection in Web Filter warning page

Risk 22

Severity

4.3

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N/E:P/RL:O/RC:C

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker in possession of a valid web filter override token to inject arbitrary headers via tricking a user into clicking on a crafted link.

First published (updated )

CVE-2025-62675

Fortinet FortiProxyHeader injection in captive portal authentication form

Risk 22

Severity

4.3

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an attacker able to intercept and modify a user's captive portal authentication request to inject arbitrary headers via crafted HTTP requests.

First published (updated )

CVE-2025-62826

Fortinet FortiProxyBuffer overread in authd and wad daemon

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow an authenticated remote attacker to return a portion of device memory in the redirect response via submitting a specially crafted request.

First published (updated )

CVE-2025-43892

Fortinet FortiOSRestricted CLI escape using Lua

Risk 60

Severity

6.7

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 all versions may allow an authenticated admin to execute lua scripts via crafted CLI commands.

First published (updated )

CVE-2025-67862

Fortinet FortiOSInteger Overflow on SSL-VPN bookmarks

Risk 38

Severity

6.5

Integer Overflow

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:X/RC:R

An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.

1 / 2

Source: MITRE

First published (updated )

CVE-2025-25248

Fortinet FortiOSDNS type 65 resource record requests bypass DNS filter

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:X/RC:X

An Improperly Implemented Security Check for Standard vulnerability [CWE-358] in FortiOS and FortiProxy may allow a remote unauthenticated user to bypass the DNS filter via Apple devices.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2024-55599

Fortinet FortiOSOut-of-bounds Write in IPSEC Daemon

Risk 35

Severity

5.9

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F/RL:W/RC:C

A out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15 allows attacker to trigger a denial of service via specially crafted packets.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-52963

Fortinet FortiOSInsufficient Session Expiration in SSL-VPN cookie

Risk 65

Severity

4.8

Exploited

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:X/RC:R

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2024-50562

Fortinet FortiOSLDAP Clear-text credentials retrievable with IP modification

Risk 26

Severity

4.4

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-32122

Fortinet FortiProxyAuthenticated user null pointer dereference in SSL-VPN

Risk 39

Severity

6.5

Null Pointer Dereference

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A null pointer dereference in Fortinet FortiOS before 7.2.5 and before 7.0.11, FortiProxy before 7.2.3 and before 7.0.9 allows attacker to denial of sslvpn service via specifically crafted request in network parameter.

1 / 2

First published (updated )

CVE-2023-33307

Fortinet FortiProxyAuthenticated user null pointer dereference in SSL-VPN

Risk 39

Severity

6.5

Null Pointer Dereference

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A null pointer dereference in Fortinet FortiOS before 7.2.5, before 7.0.11 and before 6.4.13, FortiProxy before 7.2.4 and before 7.0.10 allows attacker to denial of sslvpn service via specifically crafted request in bookmark parameter.

1 / 2

First published (updated )

CVE-2023-33306

Fortinet FortiProxyA loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7…

Risk 38

Severity

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A loop with unreachable exit condition ('infinite loop') in Fortinet FortiOS version 7.2.0 through 7.2.4, FortiOS version 7.0.0 through 7.0.10, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiProxy version 7.2.0 through 7.2.3, FortiProxy version 7.0.0 through 7.0.9, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiWeb version 7.2.0 through 7.2.1, FortiWeb version 7.0.0 through 7.0.6, FortiWeb 6.4 all versions, FortiWeb 6.3 all versions allows attacker to perform a denial of service via specially crafted HTTP requests.

First published (updated )

CVE-2023-33305

Fortinet FortiProxyFormat String Bug in cli command

Risk 63

Severity

6.7

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands

1 / 2

Source: MITRE

Remedy

Upgrade to FortiSwitchManager version 7.2.3 or above Upgrade to FortiSwitchManager version 7.0.3 or above Fortinet remediated this issue in FortiSASE version 22.4 and hence customers do not need to perform any action. Upgrade to FortiOS version 7.4.1 or above Upgrade to FortiOS version 7.2.6 or above Upgrade to FortiPAM version 1.1.1 or above Upgrade to FortiProxy version 7.2.6 or above Upgrade to FortiProxy version 7.0.12 or above

First published (updated )

CVE-2023-36640

Microsoft Windows Server 2012 R2PAN-OS: CHAP and PAP When Used with RADIUS Authentication Lead to Privilege Escalation (Severity: MEDIUM)

Risk 96

Severity

5.3

Exploited

Infoleak

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

A fundamental design flaw within the RADIUS protocol has been proven to be exploitable, compromising the integrity in the RADIUS Access-Request process. The attack allows a malicious user to modify packets in a way that would be indistinguishable to a RADIUS client or server. To be successful, the attacker must have the ability to inject themselves between the client and server.

1 / 6

Source: FortiGuard

Remedy

Disable the use of RADIUS/UDP and RADIUS/TCP - instead RADIUS/TLS or RADIUS/DTLS should be used.

Remedy

TBD

Remedy

The best way to address this issue is by using encrypted and authenticated channels that offer modern cryptographic security guarantees. Configure an alternate authentication mechanism if you are using RADIUS with a CHAP or PAP authentication protocol. PAN-OS provides the following alternate RADIUS authentication mechanisms: PEAP-MSCHAPv2 (default), PEAP with GTC, and EAP-TTLS with PAP. For more information, please see https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication/configure-radius-authentication. In addition, instead of using RADIUS, you can configure an alternate authentication mechanism using one of the options described here: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/authentication. If you are a Prisma Access customer using a RADIUS configuration with PAP or CHAP in your profile and have not applied one of the changes described above, please reach out to TAC/CS to schedule an upgrade window. PAN-OS 9.1.19, PAN-OS 10.1.14, PAN-OS 10.2.10, PAN-OS 11.0.7, PAN-OS 11.1.3, and all later PAN-OS versions add a new feature to enforce an authentication check in RADIUS. This new feature is disabled by default to match the existing behavior. To enable this feature, run the following commands: > set auth radius-require-msg-authentic yes To confirm that the setting was correctly enabled, run the following command: > show auth radius-require-msg-authentic If set correctly, the response will say "yes". This setting is persistent across reboots. No ‘commit’ is required for this to take effect. Please note that this feature requires that the RADIUS server has been updated to support the new protocol changes, as detailed in https://kb.cert.org/vuls/id/456537. If your RADIUS authentication breaks when radius-require-msg-authentic is set to yes, please work with your RADIUS server vendor for support with the RADIUS server upgrade process.

First published (updated )

CVE-2024-3596

Fortinet FortiOSMissing Authentication for critical function in CAPWAP daemon

Risk 37

Severity

6.2

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C

A missing authentication for critical function vulnerability [CWE-306] in FortiOS and FortiSwitchManager CAPWAP daemon may allow a local unauthenticated attacker on the same local IP subnet to write device configuration via specially crafted requests. To be successful, this attack requires the targeted FortiGate device to run a specific, non default configuration.

First published (updated )

Advisory

FG-IR-26-125

Fortinet FortiOSInsertion of sensitive information into REST API logs

Risk 61

Severity

6.6

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

1 / 2

Source: MITRE

Remedy

Fortinet remediated this issue in FortiSASE version 24.1.c and hence customers do not need to perform any action. Upgrade to FortiProxy version 7.4.4 or above Upgrade to FortiProxy version 7.2.12 or above Upgrade to FortiSRA version 1.6.0 or above Upgrade to FortiSRA version 1.5.0 or above Upgrade to FortiPAM version 1.6.0 or above Upgrade to FortiPAM version 1.5.0 or above Upgrade to FortiOS version 7.6.0 or above Upgrade to FortiOS version 7.4.4 or above Upgrade to FortiOS version 7.2.8 or above

First published (updated )

CVE-2024-47570

Fortinet FortiManager CloudInsertion of Sensitive Information Into Sent Data Vulnerability in csfd daemon

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C

A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiManager Cloud version 7.4.4 or above Upgrade to FortiTester version 7.6.0 or above Upgrade to FortiTester version 7.4.3 or above Upgrade to FortiNDR version 7.6.2 or above Upgrade to FortiNDR version 7.4.9 or above Upgrade to FortiManager version 7.6.2 or above Upgrade to FortiManager version 7.4.4 or above Upgrade to FortiPAM version 1.5.0 or above Upgrade to FortiPAM version 1.4.0 or above Fortinet remediated this issue in FortiSASE version 24.3.b and hence customers do not need to perform any action. Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.5 or above Upgrade to FortiOS version 7.2.9 or above Upgrade to FortiOS version 7.0.16 or above Upgrade to FortiOS version 6.4.16 or above Upgrade to FortiRecorder version 7.2.2 or above Upgrade to FortiRecorder version 7.0.5 or above Upgrade to FortiProxy version 7.4.5 or above Upgrade to FortiProxy version 7.2.11 or above Upgrade to FortiMail version 7.6.0 or above Upgrade to FortiMail version 7.4.3 or above Upgrade to FortiMail version 7.2.7 or above Upgrade to FortiWeb version 7.6.1 or above Upgrade to FortiWeb version 7.4.5 or above Upgrade to FortiVoice version 7.2.0 or above Upgrade to FortiVoice version 7.0.5 or above Upgrade to FortiVoice version 6.4.10 or above

First published (updated )

CVE-2024-47569

Fortinet FortiOSFormat String Vulnerability in CAPWAP fast-failover mode

Risk 60

Severity

6.7

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X

A Use of Externally-Controlled Format String vulnerability [CWE-134] in FortiGate may allow an authenticated admin to execute unauthorized code or commands via specifically crafted configuration.

First published (updated )

Advisory

FG-IR-25-795

Fortinet FortiOSFortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands

Risk 60

Severity

6.7

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS, FortiProxy, FortiPAM & FortiSwitchManager CLI may allow a privileged attacker to execute arbitrary code or commands via specially crafted requests.

1 / 2

Source: FortiGuard

Remedy

Please upgrade to FortiOS version 7.4.2 or above Please upgrade to FortiOS version 7.2.7 or above Please upgrade to FortiOS version 7.0.14 or above Please upgrade to FortiPAM version 1.2.0 or above Please upgrade to FortiSwitchManager version 7.2.3 or above Please upgrade to FortiSwitchManager version 7.0.3 or above Please upgrade to FortiProxy version 7.4.1 or above Please upgrade to FortiProxy version 7.2.8 or above Please upgrade to FortiProxy version 7.0.15 or above

First published (updated )

CVE-2023-40721

Fortinet FortiManager`Host` header injection

Risk 38

Severity

6.1

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C

A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison web caches via crafted HTTP requests, where the Host header points to an arbitrary webserver

1 / 2

Source: MITRE

Remedy

FortiOS Administrative Interface Upgrade to FortiOS version 7.0.6 and above, Upgrade to FortiOS version 7.2.1 and above. AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" SSLVPN interface Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection. Webfilter interface (port 8008) Upgrade to FortiOS version 7.4.0 or above Upgrade to FortiOS version 7.2.5 or above Upgrade to FortiOS version 7.0.12 or above Upgrade to FortiOS version 6.4.13 or above FortiProxy Administrative Interface Upgrade to FortiProxy version 7.0.5 and above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" SSLVPN interface Upgrade to FortiProxy version 7.4.0 or above AND Set the `server-hostname` property to the device hostname, which will disable `Host redirection` for SSL VPN: config vpn ssl settings set server-hostname Server hostname for HTTPS. When set, will be used for SSL VPN web proxy host header for any redirection. WebFilter interface (port 8008) Upgrade to FortiProxy version 7.4.0 or above Upgrade to FortiRecorder version 7.0.0 or above Upgrade to FortiRecorder version 6.4.3 or above Upgrade to FortiRecorder version 6.0.11 or above Upgrade to FortiNDR version 7.4.0 or above FortiAnalyzer & FortiManager Upgrade to version 7.6.0 or above Upgrade to version 7.4.4 or above Set the `admin-host` property to the device hostname, which will disable `Host redirection` for administrative interface. config system global set admin-host end FortiNDR Upgrade to FortiNDR version 7.2.1 or above Upgrade to FortiNDR version 7.1.1 or above AND Set the `https-redirect-host` property to the device hostname, which will disable `Host redirection`: config system global set https-redirect-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" end FortiADC Upgrade to FortiADC version 7.1.0 or above Upgrade to FortiADC version 7.0.2 or above Upgrade to FortiADC version 6.2.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" FortiDDOS-F Upgrade to FortiDDoS-F version 6.4.0 or above Upgrade to FortiDDoS-F version 6.3.4 or above AND Set the `admin-host` property to the device hostname, which will disable `Host redirection`: config system global set admin-host "Administrative host for HTTP and HTTPs. When set, will be used in lieu of the client's Host header for any redirection" Upgrade to FortiSwitch version 7.2.0 or above Upgrade to FortiSwitch version 7.0.5 or above Upgrade to FortiSwitch version 6.4.11 or above Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiMail version 7.2.0 or above Upgrade to FortiMail version 7.0.4 or above Upgrade to FortiWLC version 8.6.7 or above Upgrade to FortiAuthenticator version 6.4.2 or above Upgrade to FortiAuthenticator version 6.3.4 or above Upgrade to FortiDDoS version 5.6.0 or above Upgrade to FortiDDoS version 5.5.2 or above Upgrade to FortiSOAR version 7.3.0 or above Upgrade to FortiTester version 7.3.0 or above Upgrade to FortiTester version 7.2.2 or above

First published (updated )

CVE-2022-23439

Fortinet FortiProxyLack of certificate verification when establishing secure connections

Risk 33

Severity

4.8

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

An improper certificate validation vulnerability [CWE-295] in FortiOS 6.2 all versions, 6.4 all versions, 7.0.0 through 7.0.10, 7.2.0 and FortiProxy 1.2 all versions, 2.0 all versions, 7.0.0 through 7.0.9, 7.2.0 through 7.2.3 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server.

1 / 2

Remedy

Please upgrade to FortiOS version 7.2.1 or above Please upgrade to FortiOS version 7.0.11 or above Please upgrade to FortiProxy version 7.2.4 or above Please upgrade to FortiProxy version 7.0.10 or above

First published (updated )

CVE-2023-29175

Fortinet FortiOSImproper autorization over static files

Risk 22

Severity

4.3

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:X/RC:C

An improper authorization vulnerability [CWE-285] in FortiOS & FortiProxy may allow an authenticated attacker to access static files of others VDOMs via crafted HTTP or HTTPS requests.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiProxy version 7.6.0 or above Upgrade to FortiProxy version 7.4.9 or above Upgrade to FortiPAM version 1.4.0 or above Upgrade to FortiOS version 7.6.0 or above Upgrade to FortiOS version 7.4.2 or above Upgrade to FortiOS version 7.2.9 or above

First published (updated )

CVE-2025-54822

Fortinet FortiOS SSL VPNFortilink lack of certificate validation

Risk 34

Severity

4.8

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:X/RC:X

An improper certificate validation vulnerability [CWE-295] in FortiOS may allow an unauthenticated attacker in a Man-in-the-Middle position to decipher and alter the FortiLink communication channel between the FortiOS device and a FortiSwitch instance.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiOS version 7.4.2 or above Upgrade to FortiOS version 7.2.7 or above Upgrade to FortiOS version 7.0.16 or above

First published (updated )

CVE-2023-47537

Fortinet FortiOSFGFM protocol allows unauthenticated reset of the connection

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiProxy version 7.4.4 or above Upgrade to FortiProxy version 7.2.10 or above Upgrade to FortiPAM version 1.4.0 or above Upgrade to FortiPAM version 1.3.0 or above Upgrade to FortiOS version 7.6.0 or above Upgrade to FortiOS version 7.4.4 or above Upgrade to FortiOS version 7.2.8 or above Upgrade to FortiSwitchManager version 7.2.4 or above Upgrade to FortiSwitchManager version 7.0.4 or above

First published (updated )

CVE-2024-26008

Fortinet FortiOS SSL VPNInsufficient Session Expiration in SSLVPN using SAML authentication

Risk 40

Severity

6.5

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL VPN 7.6.0 through 7.6.2, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4 all versions may allow a remote attacker (e.g. a former admin whose account was removed and whose session was terminated) in possession of the SAML record of a user session to access or re-open that session via re-use of SAML record.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiOS version 7.6.3 or above Upgrade to FortiOS version 7.4.7 or above

First published (updated )

CVE-2025-25252

Fortinet FortiOSInteger Overflow in ipsec ike

Risk 38

Severity

6.5

Integer Overflow

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS and FortiSASE FortiOS tenant IPsec IKEv1 service may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in potential denial of service.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiOS version 7.6.1 or above Upgrade to FortiOS version 7.4.5 or above Upgrade to FortiOS version 7.2.12 or above Fortinet remediated this issue in FortiSASE version 24.4.a and hence customers do not need to perform any action.

First published (updated )

CVE-2024-46669

Fortinet FortiOSInsertion of sensitive information into REST API logs

Risk 60

Severity

6.3

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS, FortiProxy, FortiPAM and FortiSRA may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).

First published (updated )

Advisory

FG-IR-24-268

Trending

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Remedy

Company

Resources

Contact