Systems Engineering is aware of the following vulnerability in FortiGate Firewalls, FortiOS: CVE-2023-25610 / FG-IR-23-001 | FortiOS / FortiProxy - Heap buffer underflow in the administrative interface.
FortiGuard rates this vulnerability as a CRITICAL RISK.
Description
A buffer underwrite ('buffer underflow') vulnerability in FortiOS & FortiProxy administrative interface may allow a remote unauthenticated attacker to execute arbitrary code on the device and/or perform a denial of service (DoS) on the graphic user interface (GUI), via specifically crafted requests.
We will be patching for this vulnerability over the coming weeks for our SE Eventwatch, SE Essentials, and SE Secure clients.
Scope
The vulnerability was discovered internally by a Fortinet infosec engineer. Fortinet is unaware of any instance where this vulnerability was exploited in the wild.
The following FortiOS & FortiProxy versions are affected:
- FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9, 6.4.0 through 6.4.11, 6.2.0 through 6.2.12, and FortiOS 6.0 (all versions)
- FortiProxy version 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 2.0.0 through 2.0.12, 1.2 (all versions), and 1.1 (all versions)
Some hardware devices running a vulnerable FortiOS version are only impacted by the DoS part of the issue; those can be viewed in the FG-IR-23-001 advisory.
Course of Action
Systems Engineering's FortiGate Standard Build mitigates the risk of this vulnerability by locking down access to the Administrative Interface. We still recommend that our clients get their FortiGates patched for these vulnerabilities.
We will be working with our SE Eventwatch, SE Essentials, and SE Secure clients to proactively address this security vulnerability. If you have questions about this security alert, please contact your Account Manager.
For all other clients, if you would like assistance patching an affected Fortinet system, please reach out to our customer service team to have a ticket opened to receive this critical security update. Systems Engineering's Customer Service can be reached at customerservice@systemsengineering.com or 207.772.4199.
