High Threat Security Alert (A24-03-10): Multiple Vulnerabilities in Fortinet Products


 

Published on: 13 March 2024

  
  

Description:

Fortinet released security advisories to address multiple vulnerabilities in Fortinet systems. An attacker could exploit these vulnerabilities by sending specially crafted requests to an affected system.

Reports indicate that the remote code execution vulnerabilities (CVE-2023-42789, CVE-2023-42790, CVE-2023-47534 and CVE-2023-48788) in FortiClientEMS, FortiOS and FortiProxy are at a high risk of exploitation. System administrators are advised to take immediate actions to patch your affected systems to mitigate the elevated risk of cyber attacks.

 

Affected Systems:

  • FortiClientEMS version 6.0 (all versions), 6.2 (all versions), 6.4 (all versions), 7.0.0 through 7.0.10, 7.2.0 through 7.2.2
  • FortiManager version 6.2 (all versions), 6.4.0 through 6.4.13, 7.0.0 through 7.0.10, 7.2.0 through 7.2.3, 7.4.0
  • FortiOS version 6.2.0 through 6.2.15, 6.4.0 through 6.4.14, 7.0.0 through 7.0.13, 7.2.0 through 7.2.6, 7.4.0 through 7.4.1
  • FortiProxy version 2.0.0 through 2.0.13, 7.0.0 through 7.0.14, 7.2.0 through 7.2.8, 7.4.0 through 7.4.2

 

Impact:

Successful exploitation of the vulnerabilities could lead to remote code execution, escalation of privilege, information disclosure or security restriction bypass of affected system.

 

Recommendation:

Patches for affected systems are now available. Administrators of affected systems should follow the recommendations provided by the vendor and take immediate actions to mitigate the risk.

 

More Information:

  • https://www.fortiguard.com/psirt/FG-IR-23-103
  • https://www.fortiguard.com/psirt/FG-IR-23-328
  • https://www.fortiguard.com/psirt/FG-IR-23-390
  • https://www.fortiguard.com/psirt/FG-IR-23-424
  • https://www.fortiguard.com/psirt/FG-IR-24-007
  • https://www.fortiguard.com/psirt/FG-IR-24-013
  • https://www.hkcert.org/security-bulletin/fortinet-products-multiple-vulnerabilities_20240313
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36554
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42789 (to CVE-2023-42790)
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46717
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47534
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48788
  • https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23112


Tag: Fortinet , FortiClientEMS , FortiManager , FortiOS , FortiProxy
Tags