Refine
RESET


Filter by Date:
All
Filter by Risk Level:
All

PSIRT Advisories

The FortiGuard Labs Product Security Incident Response Team (PSIRT) continually test Fortinet hardware and software products, looking for vulnerabilities and weaknesses. Any such findings are fed back to Fortinet's development teams and serious issues are described along with protective solutions in the advisories below.

PMKID attack on WPA/WPA2 WiFi networks
Makers of popular WiFi hacking tool hashcat have discovered a way to improve password brute-forcing of the WPA/WPA2 wifi network...
Jan 27, 2020 Risk IR Number: FG-IR-18-199
FortiMail admin privilege escalation through improper user profile control
Two improper access control vulnerabilities in FortiMail admin webUI may allow administrators to perform privileged functions...
Jan 03, 2020 Risk IR Number: FG-IR-19-237
TCP SACK panic attack- Linux Kernel Vulnerabilities- CVE-2019-11477, CVE-2019-11478 & CVE-2019-11479
CVE-2019-11477:The Linux kernel is vulnerable to an integer overflow in the 16 bit width of  TCP_SKB_CB(skb)->tcp_gso_segs.  A...
Nov 29, 2019 Risk IR Number: FG-IR-19-180
SSL VPN buffer overrun when parsing javascript href content
A heap buffer overflow vulnerability in the FortiOS SSL VPN web portal may cause the SSL VPN web service termination for logged...
Nov 26, 2019 Risk IR Number: FG-IR-18-388
FortiOS system file leak through SSL VPN via specially crafted HTTP resource requests
A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system...
Nov 26, 2019 Risk IR Number: FG-IR-18-384
IPMI network LAN interface failover operational risk
Some models of FortiAnalyzer and FortiManager have a default setting of "Failover", for remote IPMI access; this means that if...
Sep 17, 2019 Risk IR Number: FG-IR-17-195
Unauthenticated SSL VPN users password modification
An Improper Authorization vulnerability in the SSL VPN web portal may allow an unauthenticated attacker to change the password...
Aug 30, 2019 Risk IR Number: FG-IR-18-389
Wind River VxWorks IPnet TCP/IP Stack Vulnerabilities (aka. URGENT/11)
11 zero day vulnerabilities (aka. URGENT/11) were disclosed in VxWorks® TCP/IP stack (IPnet):CVE-2019-12255 - TCP Urgent Pointer...
Aug 26, 2019 Risk IR Number: FG-IR-19-222
FortiRecorder sets credentials of FortiCameras to static values
An Use of Hard-coded Credentials vulnerability in FortiRecorder may allow an unauthenticated attacker with knowledge of the aforementioned...
Aug 12, 2019 Risk IR Number: FG-IR-19-185
CVE-2016-10229 Linux Kernel ipv4/udp.c Remote Code Execution Vulnerability
Multiple Fortinet products may be affected by the following Linux Kernel vulnerability:CVE-2016-10229 Linux Kernel ipv4/udp.c...
Jul 24, 2019 Risk IR Number: FG-IR-17-118
Unprivileged, authenticated user can change the routing settings
An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings...
Apr 04, 2019 Risk IR Number: FG-IR-18-230
Format String Vulnerability in SSH username
There is a format string vulnerability in the SSH username handling when connecting to FortiOS 5.6.0, that may lead to memory...
Jan 11, 2019 Risk IR Number: FG-IR-18-018
CVE-2018-10933 libssh authentication bypass
libssh versions 0.6 and above have an authentication bypass vulnerability inthe server code. By presenting the server an SSH2_MSG_USERAUTH_SUCCESS...
Nov 21, 2018 Risk IR Number: FG-IR-18-336
FortiClient insecure VPN credential storage and encryption
In certain conditions, FortiClient users' VPN credentials are stored in improperly secured locations and unsafely encrypted.[CVE-2017-14184]When...
Apr 20, 2018 Risk IR Number: FG-IR-17-214
FortiWeb's cookie tampering protection can be bypassed by erasing the FortiWeb session cookie
An improper access control vulnerability in FortiWeb's Signed Security mode may allow an attacker to disable the cookie tampering...
Mar 06, 2018 Risk IR Number: FG-IR-17-279