PSIRTWeak Authentication in csfd daemon
Summary
A Weak Authentication vulnerability [CWE 1390] in FortiOS, FortiPAM and FortiProxy csfd daemon may allow an unauthenticated attacker with access to the Security Fabric interface and port to bruteforce the authentication process in the Security Fabric protocol and take control of the devices of the Fabric.
A Weak Authentication vulnerability [CWE 1390] of the same nature in Fortimanager csfd daemon may allow an unauthenticated attacker with access to the Security Fabric interface and port to bypass the authentication process and access a restricted list of features.
| Version | Affected | Solution |
|---|---|---|
| FortiAnalyzer Cloud 7.4 | 7.4.1 through 7.4.3 | Upgrade to 7.4.4 or above |
| FortiAnalyzer 7.6 | 7.6.0 through 7.6.1 | Upgrade to 7.6.2 or above |
| FortiAnalyzer 7.4 | 7.4.1 through 7.4.3 | Upgrade to 7.4.4 or above |
| FortiAnalyzer 7.2 | Not affected | Not Applicable |
| FortiAnalyzer 7.0 | Not affected | Not Applicable |
| FortiAuthenticator 6.6 | Not affected | Not Applicable |
| FortiAuthenticator 6.5 | Not affected | Not Applicable |
| FortiAuthenticator 6.4 | Not affected | Not Applicable |
| FortiAuthenticator 6.3 | Not affected | Not Applicable |
| FortiAuthenticator 6.2 | Not affected | Not Applicable |
| FortiManager 7.6 | 7.6.0 through 7.6.1 | Upgrade to 7.6.2 or above |
| FortiManager 7.4 | 7.4.1 through 7.4.3 | Upgrade to 7.4.4 or above |
| FortiManager 7.2 | Not affected | Not Applicable |
| FortiManager 7.0 | Not affected | Not Applicable |
| FortiManager Cloud 7.4 | 7.4.1 through 7.4.3 | Upgrade to 7.4.4 or above |
| FortiOS 7.6 | Not affected | Not Applicable |
| FortiOS 7.4 | 7.4.0 through 7.4.4 | Upgrade to 7.4.5 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.8 | Upgrade to 7.2.9 or above |
| FortiOS 7.0 | 7.0.0 through 7.0.15 | Upgrade to 7.0.16 or above |
| FortiOS 6.4 | 6.4 all versions | Migrate to a fixed release |
| FortiProxy 7.6 | Not affected | Not Applicable |
| FortiProxy 7.4 | 7.4.0 through 7.4.4 | Upgrade to 7.4.5 or above |
| FortiProxy 7.2 | 7.2.0 through 7.2.10 | Upgrade to 7.2.11 or above |
| FortiProxy 7.0 | 7.0.0 through 7.0.17 | Upgrade to 7.0.18 or above |
| FortiProxy 2.0 | 2.0.0 through 2.0.14 | Upgrade to 2.0.15 or above |
| FortiSASE 24.4 | Not affected | Not Applicable |
| FortiSASE 23.3 | Not affected | Not Applicable |
| FortiSASE 23.2 | Not affected | Not Applicable |
| FortiSASE 23.1 | Not affected | Not Applicable |
Workarround :
Choose a strong password (at least 20 characters, randomly generated) for field group-password in config system csf CLI command
Another option is to disable the security fabric :
config system csf
set status disable
end