Critical · published October 18, 2022
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 An unauthenticated attacker can waltz right into your admin interface with just a crafted HTTP request! 🔥 Think of it like a restaurant where anyone can sneak past the host and head straight to the kitchen with no reservation needed. Instead of a delectable meal, they could wreak havoc on your operations! This vulnerability allows attackers to perform administrative actions without ever logging in, potentially compromising the entire system. An attacker could change configurations, access sensitive information, or even disrupt services entirely, leading to catastrophic consequences for your organization.
Think of it like a restaurant where anyone can sneak past the host and head straight to the kitchen with no reservation needed. Instead of a delectable meal, they could wreak havoc on your operations! This authentication bypass vulnerability affects Fortinet FortiOS, FortiProxy, and FortiSwitchManager by allowing attackers to access the administrative interface through specially crafted requests, skipping the usual authentication checks.
This vulnerability allows attackers to perform administrative actions without ever logging in, potentially compromising the entire system. An attacker could change configurations, access sensitive information, or even disrupt services entirely, leading to catastrophic consequences for your organization. Patch your Fortinet devices immediately to the latest versions (7.2.2 or later for FortiOS and FortiProxy; 7.0.7 or later for FortiSwitchManager) to close this critical hole. Make sure to audit your system for any unauthorized changes that may have been made during exposure. You've got this! Stay vigilant and patch up your systems to bolster defenses against this exploit! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortinet/fortiproxy | ≥ 7.0.0, < 7.0.7 | 7.0.7 |
| fortinet/fortiproxy | all versions | — |
| fortinet/fortiswitchmanager | all versions | — |
| fortinet/fortiswitchmanager | all versions | — |
| fortinet/fortios | ≥ 7.0.0, < 7.0.7 | 7.0.7 |
| fortinet/fortios | ≥ 7.2.0, < 7.2.2 | 7.2.2 |