Open Nav
Sign Up

FortiOS and FortiProxy Vulnerability

Critical Vulnerability - FortiOS and FortiProxy Vulnerability

Bar Refael

January 10, 2024

Based on a recent advisory from the Cybersecurity and Infrastructure Security Agency (CISA), Fortinet has released a crucial security update to address a vulnerability in FortiOS and FortiProxy software. This update is a preventative measure against potential cyber threats that could exploit this vulnerability to gain control of affected systems.

Vulnerability Details:

  • Type: Improper Privilege Management Vulnerability [CWE-269]
  • Affected Software: FortiOS and FortiProxy
  • Impact: An authenticated attacker may exploit this vulnerability to perform unauthorized actions in a High Availability (HA) cluster via crafted HTTP or HTTPS requests.

Affected Versions and Solutions:

  • FortiOS 7.4: Versions 7.4.0 through 7.4.1 should upgrade to 7.4.2 or above.
  • FortiOS 7.2: Version 7.2.5 should upgrade to 7.2.6 or above.
  • FortiProxy 7.4: Versions 7.4.0 through 7.4.1 should upgrade to 7.4.2 or above.
  • Upgrade Assistance: Use Fortinet’s upgrade tool at https://docs.fortinet.com/upgrade-tool.
  • Virtual Patch: “FortiOS.HA.RestAPI.Authentication.Bypass” available in FMWP db update 23.104.

CISA Advisory:

CISA urges users and administrators to review the FG-IR-23-315 FortiOS & FortiProxy security bulletin and apply necessary updates to mitigate the risk effectively.

OP Innovate Recommendations:

  • Update Systems: Ensure affected versions of FortiOS and FortiProxy are updated as per guidelines.
  • Apply Virtual Patch: If immediate upgrade is not feasible, utilize the virtual patch provided.
  • Enhanced Monitoring: Post-upgrade, monitor systems for any signs of security breaches or unusual activities.
  • Stay Informed: Keep abreast of updates from Fortinet and ongoing advisories from CISA.

This vulnerability in FortiOS and FortiProxy underlines the importance of timely updates and cybersecurity vigilance. OP Innovate emphasizes the need for quick action in line with CISA’s advisory and is dedicated to supporting our customers through these updates.

Resources highlights

Cisco IOS and IOS XE SNMP Zero-Day Actively Exploited (CVE-2025-20352)

Cisco disclosed CVE-2025-20352, a stack overflow in the SNMP subsystem of IOS and IOS XE, now confirmed as actively exploited in the wild. Attackers can…

Read more >

CVE-2025-20352

SolarWinds Web Help Desk (WHD) Unauthenticated RCE Patch-Bypass (CVE-2025-26399)

SolarWinds released Web Help Desk 12.8.7 Hotfix 1 to fix CVE-2025-26399, an unauthenticated remote code execution flaw in the AjaxProxy component caused by unsafe deserialization.…

Read more >

CVE-2025-26399

SonicWall Cloud Backup Compromise & Ongoing SSLVPN Exploitation

Threat actors gained access to MySonicWall cloud backup preference files after brute-forcing the vendor’s portal. These files, although encrypted, contain sensitive configuration data such as…

Read more >

sonicwall cloud

Ongoing Supply-Chain Attack Targeting npm Packages (aka “Shai-Hulud”)

Beginning on September 14, 2025, and accelerating over the next two days, attackers launched a large-scale supply-chain attack against the npm ecosystem. The campaign injected…

Read more >

Shai-Hulud

FBI Advisory: UNC6040/UNC6395 Targeting Salesforce Environments

The FBI has issued a FLASH advisory detailing activity from the threat groups UNC6040 and UNC6395, who are actively conducting data theft and extortion campaigns…

Read more >

salesforce fbi advisory

CVE-2024-40766: SonicWall SSL VPN Flaw Actively Exploited by Ransomware Threat Actors

CVE-2024-40766 is a critical improper access control vulnerability in SonicWall SonicOS management access/SSLVPN. Successful exploitation enables unauthorized access and can, in some cases, crash the…

Read more >

CVE-2024-40766
Under Cyber Attack?

Fill out the form and we will contact you immediately.