Critical Out-of-Bounds Write Vulnerability in Fortinet FortiOS and FortiProxy

What changed

A significant out-of-bounds write vulnerability has been identified in Fortinet's FortiOS and FortiProxy products. This flaw allows attackers to execute unauthorized code or commands through specially crafted requests.

The vulnerability affects various versions of FortiOS and FortiProxy, necessitating immediate attention from users and administrators.

Who is affected

Organizations utilizing Fortinet products should be aware of the affected versions to mitigate risks effectively. The vulnerability spans multiple versions of both FortiOS and FortiProxy.

Affected products include:

• Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, and 6.0.0 through 6.0.17.
• Fortinet FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, and 1.0.0 through 1.0.
• Organizations relying on these versions for network security and management.

What to do

It is crucial for affected users to assess their systems and apply the latest patches provided by Fortinet. Immediate action is recommended to prevent potential exploitation of this vulnerability.

Administrators should review their security configurations and ensure that all systems are updated to the latest secure versions.

• Check for updates from Fortinet and apply patches for the affected versions.
• Monitor network traffic for any suspicious activities that may indicate exploitation attempts.
• Review and enhance security policies to mitigate risks associated with unauthorized code execution.