PSIRT Advisory

Unprivileged, authenticated user can change the routing settings


An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing settings of the device via connecting to the ZebOS component.


Execute unauthorized code or commands

Affected Products

FortiOS version 6.0.2 and below
FortiOS version  5.6.7 and below
FortiOS version  5.4.10 and below


Upgrade to FortiOS version 6.0.3 or above
Upgrade to FortiOS version 5.6.8 and above
Upgrade to upcoming FortiOS version 5.4.11 and above


Fortinet thanks Thomas Hochmuth  for reporting this vulnerability.