Critical Authentication Bypass Vulnerability in Fortinet FortiOS and FortiProxy

What changed

Fortinet has disclosed an authentication bypass vulnerability affecting its FortiOS and FortiProxy products. This vulnerability allows remote attackers to exploit crafted requests to gain super-admin privileges.

The flaw is categorized under CWE-288, indicating an authentication bypass via an alternate path or channel, which poses a serious risk to the integrity and security of affected systems.

Who is affected

Organizations using Fortinet's FortiOS versions 7.0.0 through 7.0.16 and FortiProxy versions 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 are at risk. This vulnerability could lead to unauthorized access and control over critical network functions.

The following groups are particularly vulnerable:

• Fortinet FortiOS users (versions 7.0.0 to 7.0.16)
• Fortinet FortiProxy users (versions 7.0.0 to 7.0.19 and 7.2.0 to 7.2.12)
• Organizations relying on Fortinet for network security solutions
• IT administrators managing Fortinet products in enterprise environments

What to do

It is crucial for affected organizations to assess their systems for the presence of this vulnerability and take immediate action to mitigate risks. Fortinet recommends upgrading to the latest patched versions of FortiOS and FortiProxy to eliminate this security gap.

In addition, organizations should implement the following measures:

• Review and update FortiOS and FortiProxy to the latest versions provided by Fortinet.
• Monitor network traffic for any unusual activity that may indicate exploitation attempts.
• Ensure that access controls and authentication mechanisms are robust and regularly audited.
• Stay informed about further updates from Fortinet and relevant cybersecurity advisories.