Summary
New vulnerabilities discovered in some Fortinet products, including 4 with a “high” severity.
Risk
Vulnerability community impact estimate: Medium (64.87)
Type
- Arbitrary Code Execution
- Privilege Escalation
Affected products and versions
FortiSandbox
- 5.0, version 5.0.0
- 4.4, from version 4.4.0 to 4.4.6
- 4.2, from version 4.2.0 to 4.2.7
- 4.0, from version 4.0.0 to 4.0.5
- 3.2, all versions
- 3.1, all versions
- 3.0, from version 3.0.5 to 3.0.7
FortiOS
- 7.4, from version 7.4.0 to 7.4.4
- 7.2, from version 7.2.0 to 7.2.9
- 7.0, from version 7.0.0 to 7.0.15
- 6.4, versions 6.4.0 to 6.4.15
- 6.2, all versions
FortiPAM
- 1.4, versions 1.4.0 to 1.4.2
- 1.3, versions 1.3.0 to 1.3.1
- 1.2, all versions
- 1.1, all versions
- 1.0, all versions
FortiProxy
- 7.6, version 7.6.0
- 7.4, versions 7.4.0 to 7.4.6
- 7.2, versions 7.2.0 to 7.2.12
- 7.0, versions 7.0.0 to 7.0.19
FortiSRA
- 1.4, versions 1.4.0 to 1.4.2
FortiWeb
- 7.4, versions 7.4.0 to 7.4.5
- 7.2, from version 7.2.0 to 7.2.10
- 7.0, from version 7.0.0 to 7.0.10
Mitigation actions
In line with the vendor statements, it is recommended to apply mitigations following the indications of the security bulletins available in the References section.
Below are only the CVEs related to the vulnerabilities with a “high” severity:
References
https://www.fortiguard.com/psirt/FG-IR-24-261
https://www.fortiguard.com/psirt/FG-IR-24-325
https://www.fortiguard.com/psirt/FG-IR-24-306
https://www.fortiguard.com/psirt/FG-IR-24-327
https://www.fortiguard.com/psirt
1This estimate is made taking into account several parameters, including: CVSS, availability of patches/workarounds and PoC, diffusion of the affected software/devices in the reference community.
