8 source-linked records in the current knowledge graph.
Fortinet FortiOS contains a use of hard-coded credentials vulnerability that could allow an attacker to cipher sensitive data in FortiOS configuration backup file via knowledge of the hard-coded key. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionFortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA KEV ↗ · unattributed attributionFortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionMultiple versions of Fortinet FortiOS SSL-VPN contain a heap-based buffer overflow vulnerability which can allow an unauthenticated, remote attacker to execute arbitrary code or commands via specifically crafted requests. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionFortinet FortiOS "execute restore src-vis" downloads code without integrity checking, allowing an attacker to arbitrarily download files. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionFortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol (LDAP) server. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionFortinet FortiOS SSL VPN contains an improper authentication vulnerability that may allow a user to login successfully without being prompted for the second factor of authentication (FortiToken) if they change the case in their username. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attributionFortinet FortiOS SSL VPN web portal contains a path traversal vulnerability that may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource requests. Required action: Apply updates per vendor instructions.
CISA KEV ↗ · unattributed attribution