Helient Systems_ Critical Security Advisory: Fortinet PSIRT Discloses Multiple Vulnerabilities in FortiSIEM, FortiProxy, FortiOS, FortiClientEMS, and FortiManager

Fortinet’s PSIRT (Product Security Incident Response Team) has released their vulnerability findings for February 2024. Multiple command injection vulnerabilities in FortiSIEM supervisor.

Why Should You Be Concerned?

Quality hardware and software vendors (like Fortinet) do their best to monitor and quickly remediate any vulnerabilities found in their products. Without patching those vulnerabilities, you leave yourself, your company, and your clients susceptible to attacks, potentially permitting threat actors access to your environment and data.

What Can Be Done?

Remember, timely updates are your first line of defense against potential cyber threats!

Don’t Delay—Reach Out for Expert Assistance

We at Helient monitor vulnerability release information from the security community and our vendors in order to stay on top of current threats and to ensure our client’s environments are patched and secured as quickly as possible.

What Is Affected?

This CVE affects the following:

[ FortiSASE – FortiProxy – FortiOS ] FortiOS & FortiProxy – CVE-2023-44487 – Rapid Reset HTTP/2 vulnerability

[ FortiOS ] FortiOS – Fortilink lack of certificate validation

[ FortiSASE – FortiProxy – FortiOS ] FortiOS – Out-of-bound Write in sslvpnd

[ FortiWeb – FortiVoice – FortiSwitchManager – FortiSASE – FortiProxy – FortiPAM – FortiOS – FortiAuthenticator ] FortiOS – Format String Bug in fgfmd

[ FortiClientEMS ] FortiClientEMS – Improper privilege management for site super administrator

[ FortiManager – FortiAnalyzer-BigData – FortiAnalyzer ] FortiManager – Informative error messages

FortiAnalyzer:

[ FortiSIEM ] FortiSIEM – Multiple remote unauthenticated os command injection

• FortiSIEM version 7.1.0 through 7.1.1
• FortiSIEM version 7.0.0 through 7.0.2
• FortiSIEM version 6.7.0 through 6.7.8
• FortiSIEM version 6.6.0 through 6.6.3
• FortiSIEM version 6.5.0 through 6.5.2
• FortiSIEM version 6.4.0 through 6.4.2

FortiAnalyzer – BigData:

Forti Manager:

[ FortiNAC ] FortiNAC – XSS in Show Audit Log

We recognize the challenges that can accompany implementing critical security updates. That’s why our team of industry-leading networking experts stands ready to offer guidance and support.

For a smooth and effective upgrade process, contact us at service@helient.com.