28. 03. 2024
SOCnews
On February 8, 2024, Fortinet disclosed 2 critical vulnerabilities which could allow remote code or command execution. The vulnerabilities are as follows:
FortiOS – Format String Bug in fgfmd, with CVSS severity 9.8
The versions prone to this vulnerability are:
| Version | Affected | Solution |
|---|---|---|
| FortiOS 7.4 | 7.4.0 through 7.4.2 | Upgrade to 7.4.3 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.6 | Upgrade to 7.2.7 or above |
| FortiOS 7.0 | 7.0.0 through 7.0.13 | Upgrade to 7.0.14 or above |
FortiOS – Out-of-bound Write in sslvpnd, with CVSS severity 9.6
The versions prone to this vulnerability are:
| Version | Affected | Solution |
|---|---|---|
| FortiOS 7.6 | Not affected | Not Applicable |
| FortiOS 7.4 | 7.4.0 through 7.4.2 | Upgrade to 7.4.3 or above |
| FortiOS 7.2 | 7.2.0 through 7.2.6 | Upgrade to 7.2.7 or above |
| FortiOS 7.0 | 7.0.0 through 7.0.13 | Upgrade to 7.0.14 or above |
| FortiOS 6.4 | 6.4.0 through 6.4.14 | Upgrade to 6.4.15 or above |
| FortiOS 6.2 | 6.2.0 through 6.2.15 | Upgrade to 6.2.16 or above |
| FortiOS 6.0 | 6.0 all versions | Migrate to a fixed release |
It is recommended to apply the patches provided by the vendor as soon as possible.
Massimo Giaimo
Team Leader Cyber Security at Würth Phoenix
Author
Latest posts by Massimo Giaimo
21. 03. 2024
SOCnews
SOC News | Mar 21 – IABs and Bulk Sales
03. 02. 2024
SOCnews
SOC News | Feb 04 – AnyDesk Compromise
24. 12. 2023
SOCnews
SMTP Smuggling – A Quick Summary