RCE vulnerability affecting Fortinet products

FortiOS

• 7.4.0 through 7.4.2
• 7.2.0 through 7.2.6
• 7.0.0 through 7.0.13

FortiProxy

• 7.4.0 through 7.4.2
• 7.2.0 through 7.2.8
• 7.0.0 through 7.0.15

FortiPAM

• 1.2.x
• 1.1.x
• 1.0.x

FortiWeb

• 7.4.0 through 7.4.2

Listed Fortinet products are vulnerable to CVE-2024-23113 that is being reported as under active exploitation.

Note: FortiOS 6.x and FortiPAM 1.3 are not affected.

If you are running Fortinet products within the listed version range.

FortiOS products need to be upgraded to:

• FortiOS 7.4.3 or above
• FortiOS 7.2.7 or above
• FortiOS 7.0.14 or above

FortiPAM products listed above need to be migrated to a fixed release.

FortiProxy products need to be upgraded to:

• FortiProxy 7.4.3 or above
• FortiProxy 7.2.9 or above
• FortiProxy 7.0.16 or above

FortiWeb 7.4 needs to be upgraded to 7.4.3 or above.

For each interface, remove the fgfm access, for example change from:

config system interface
edit "portX"
set allowaccess ping https ssh fgfm
next
end

to:

config system interface
edit "portX"
set allowaccess ping https ssh
next
end

This will prevent FortiGate discovery from FortiManager. Connection will still be possible from FortiGate.