Fortinet has released a security patch addressing 15 vulnerabilities, including one critical flaw affecting FortiOS and FortiProxy allowing for a remote takeover by a threat actor if exploited. The flaw was reported internally by Fortinet’s internal security team and is tracked as CVE-2023-25610 with a CVSS score of 9.3 out of 10.
The vulnerability affects the following FortiOS and Fortiproxy versions:
- FortiOS versions 7.2.0 – 7.2.3
- FortiOS versions 7.0.0 – 7.0.9
- FortiOS versions 6.4.0 – 6.4.11
- FortiOS version 6.2.0 – 6.2.12
- FortiOS 6.0 all versions
- FortiProxy versions 7.2.0 – 7.2.2
- FortiProxy versions 7.0.0 – 7.0.8
- FortiProxy versions 2.0.0 – 2.0.11
- FortiProxy 1.2 all versions
- FortiProxy 1.1 all versions
According to Fortinet’s advisory, this is a buffer underwrite vulnerability in the FortiOS and Fortiproxy administrative interface that can allow a remote threat actor to run malicious code on the target device or perform a DoS attack on the GUI using a specifically crafted request. This can also lead to memory corruptions that can cause crashes and run malicious code.
Fortinet claims that there’s no evidence of any exploitation attempts so far. That said, it’s recommended that network admins apply the released patches as soon as possible as Fortinet’s products are often attacked in the wild. Patches are available for the following versions:
- FortiOS versions 6.2.13, 6.4.12, 7.0.10, 7.2.4, and 7.4.0
- FortiOS-6K7K versions 6.2.13, 6.4.12, and 7.0.10
- FortiProxy versions 2.0.12, 7.0.9, and 7.0.9
For those who can’t apply the patches right away, Fortinet recommends disabling the HTTP/HTTPS administrative interface or limiting the IP addresses allowed to access the interface. This can be done using an Address Group. Users employing non-default ports will have to create appropriate service objects for GUI administrative access.
In the News: Google One gets VPN and Dark Web monitoring across all tiers
