PSIRT Advisories

The FortiGuard Labs Product Security Incident Response Team (PSIRT) continually test Fortinet hardware and software products, looking for vulnerabilities and weaknesses. Any such findings are fed back to Fortinet's development teams and serious issues are described along with protective solutions in the advisories below.

An admin user with super_admin privileges can execute an arbitrary binary contained on an USB drive plugged to a FortiGate, via...

May 18, 2018 Risk IR Number: FG-IR-17-245
FortiWeb's "Recursive URL Decoding" feature can detect URL-based attacks (among which XSS and SQL injection attempts) even when...

May 16, 2018 Risk IR Number: FG-IR-18-058
US-Cert published a document at https://www.us-cert.gov/ncas/alerts/TA17-075A which outlines some security flaws that may be introduced...

May 16, 2018 Risk IR Number: FG-IR-17-160
A collection of AMD vulnerabilities known as "Ryzenfall, Fallout, Chimera, Masterkey" has been released. Attackers in possession...

Apr 13, 2018 Risk IR Number: FG-IR-18-046
A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption is possible without...

Dec 22, 2017 Risk IR Number: FG-IR-17-302
An admin user with super_admin privileges (i.e. with a super_admin profile) may view the current sslvpn web portal session info,...

Dec 08, 2017 Risk IR Number: FG-IR-17-172
Before Dec 5th, 2017, a Cross-Site-Scripting (XSS) vulnerability in forticloud.com on-demand sandbox GUI may have allowed an authenticated...

Dec 08, 2017 Risk IR Number: FG-IR-17-259
A Cross-site Scripting (XSS) vulnerability in FortiOS SSL-VPN web portal may allow an authenticated user to inject arbitrary web ...

Nov 23, 2017 Risk IR Number: FG-IR-17-242
There exists a persistent Cross-site Scripting (XSS) vulnerability on FortiWeb's webUI Certificate View page, which can be triggered...

Nov 17, 2017 Risk IR Number: FG-IR-17-131
A reflected XSS vulnerability exists in FortiOS web proxy disclaimer response web pages, potentially  exploitable by an unauthenticated...

Nov 03, 2017 Risk IR Number: FG-IR-17-168
FortiOS SSL Deep-Inspection may enable insecure renegotiation between TLS clients and servers that support secure renegotiation,...

Nov 03, 2017 Risk IR Number: FG-IR-17-137
An authenticated user may pass a specially crafted payload to the 'params' parameter of the JSON web API (URLs with /json) , which...

Oct 24, 2017 Risk IR Number: FG-IR-17-206
A reflected XSS vulnerability exists in FortiOS web GUI "Login Disclaimer" redir parameter. It is potentially exploitable by a...

Oct 24, 2017 Risk IR Number: FG-IR-17-113
The FortiWLC file management AP script download webUI page is affected by an OS Command Injection vulnerability which may allow...

Oct 13, 2017 Risk IR Number: FG-IR-17-119
The FortiWLC admin webUI is affected by XSS vulnerabilities, potentially exploitable by an authenticated user, via non-sanitized...

Oct 13, 2017 Risk IR Number: FG-IR-17-106