PSIRT Advisories

Monthly PSIRT Advisories

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.  

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

US-Cert published a document at https://www.us-cert.gov/ncas/alerts/TA17-075A which outlines some security flaws that may ...

May 16, 2018 Risk IR Number: FG-IR-17-160 CVE-2005-4900
FortiWLC included two hardcoded accounts which were used by Meru Access Points to report core dumps; these accounts had re...

May 04, 2018 Risk IR Number: FG-IR-17-274 CVE-2017-17539
In certain conditions, FortiClient users' VPN credentials are stored in improperly secured locations and unsafely encrypte...

Apr 20, 2018 Risk IR Number: FG-IR-17-214 CVE-2017-14184
A collection of AMD vulnerabilities known as "Ryzenfall, Fallout, Chimera, Masterkey" has been released. Attackers in poss...

FortiAnalyzer FortiAP 5.2, 5.6 FortiOS 5.2, 4.2 FortiSwitch
Apr 13, 2018 Risk IR Number: FG-IR-18-046 CVE-2018-8930
A new side-channel attack that takes advantage of the speculative execution feature of modern processors to recover data f...

Apr 03, 2018 Risk IR Number: FG-IR-18-067
An improper access control vulnerability in FortiWeb's Signed Security mode may allow an attacker to disable the cookie ta...

FortiWeb 6.0.7, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.9.1, 5.9.0, 5.8.7, 5.8.6, 5.8.5, 5.8.3, 5.8.2, 5.8.1, 5.8.0, 5.7.3, 5.7.2, 5.7.1, 5.7.0, 5.6.2, 5.6.1, 5.6.0
Mar 06, 2018 Risk IR Number: FG-IR-17-279 CVE-2017-14191
The FortiOS web proxy disclaimer page is potentially vulnerable to an XSS attack, via maliciously crafted "Host" headers i...

FortiOS 5.6.2, 5.6.1, 5.6.0, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.9, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.15, 5.2.14, 5.2.13, 5.2.12, 5.2.11, 5.2.10, 5.2.1, 5.2.0
Jan 22, 2018 Risk IR Number: FG-IR-17-262 CVE-2017-14190
Intel recently released a security update (Intel-SA-00086), regarding Intel ME 11.x, SPS 4.0, and TXE 3.0 intel products.T...

Jan 04, 2018 Risk IR Number: FG-IR-17-271
When the "VPN before logon" feature of FortiClient Windows is enabled (disabled by default), and when the server certifica...

Dec 13, 2017 Risk IR Number: FG-IR-17-070 CVE-2017-7344
An admin user with super_admin privileges (i.e. with a super_admin profile) may view the current sslvpn web portal session...

FortiOS 5.6.2, 5.6.1, 5.6.0, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.1, 5.4.0, 5.2.9, 5.2.8, 5.2.7, 5.2.6, 5.2.5, 5.2.4, 5.2.3, 5.2.2, 5.2.15, 5.2.14, 5.2.13, 5.2.12, 5.2.11, 5.2.10, 5.2.1, 5.2.0
Dec 08, 2017 Risk IR Number: FG-IR-17-172 CVE-2017-7738
Before Dec 5th, 2017, a Cross-Site-Scripting (XSS) vulnerability in forticloud.com on-demand sandbox GUI may have allowed ...

Dec 08, 2017 Risk IR Number: FG-IR-17-259
FortiWebManager 5.8.0 fails to check the admin password, granting access regardless the provided string.

Nov 22, 2017 Risk IR Number: FG-IR-17-248 CVE-2017-14189
There exists a persistent Cross-site Scripting (XSS) vulnerability on FortiWeb's webUI Certificate View page, which can be...

Nov 17, 2017 Risk IR Number: FG-IR-17-131 CVE-2017-7736
An old Infineon RSA library does not properly generate RSA key pairs, therefore enabling an attacker to potentially infer ...

Nov 03, 2017 Risk IR Number: FG-IR-17-249 CVE-2017-15361
A collection of Bluetooth implementation vulnerabilities known as "BlueBorne" has been released. These vulnerabilities col...

Nov 03, 2017 Risk IR Number: FG-IR-17-212 CVE-2017-1000251