Fortinet Released Security Updates – 10 October 2022

By /
  • 228/2022
  • Critical

Fortinet has released security updates to address multiple vulnerabilities across multiple products. The remote attacker could exploit some of these vulnerabilities to take control of the affected system.

The highest severity of the addressed vulnerabilities could allow the attacker to execute arbitrary commands in the underlying shell due to multiple improper neutralization of special elements used in an OS command injection vulnerabilities [CWE-78] in Console, Telnet, and SSH login components of FortiTester.

Sample of the addressed vulnerabilities:

1. FortiTester – Unauthenticated command injection (CVE-2022-33873):

• CVSS: 9.6

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Consequences: Gain Access

2. FortiOS / FortiProxy – Access to NULL pointer in SSL VPN portal (CVE-2022-29055):

• CVSS: 7.3

• Attack Vector: Network

• Attack Complexity: Low

• Privileges Required: None

• User Interaction: None

• Consequences: Denial of service

Vulnerabilities

CVE-ID

Affected products

CVE-2022-26121

FortiAnalyzer
FortiManager

CVE-2021-44171

FortiOS

CVE-2022-40684

FortiOS
FortiProxy
FortiSwitchManager

CVE-2022-35844

FortiTester

CVE-2022-35846

CVE-2022-33873

CVE-2022-29055

FortiOS 
FortiProxy

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed.
Fortinet Security Advisor

References

Fortinet Security Advisor