Fortinet Security Updates – 10 April 2024

By /
  • 110/2024
  • Critical
  • 1:27 pm

Fortinet has released security updates to fix several vulnerabilities across multiple Fortinet products.

The addressed vulnerabilities could allow the attacker to execute arbitrary code, and gain access to the affected products by sending specially crafted requests.

Sample of the addressed vulnerabilities:

1. FortiClient Linux Remote Code Execution Vulnerability (CVE-2023-45590):

  • CVSS: 9.4
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Consequences: Gain Access

2. FortiSandbox – OS Command Injection Vulnerability (CVE-2024-21755):

  • CVSS: 8.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Gain Access

The affected products:

  • FortiClientLinux.
  • FortiSandbox.
  • FortiOS.
  • FortiProxy.
  • FortiManager.
  • FortiClientMac.
Vulnerabilities
  • CVE-2023-45590
  • CVE-2024-21755
  • CVE-2024-23662
  • CVE-2023-48784
  • CVE-2024-21756
  • CVE-2023-47540
  • CVE-2023-47541
  • CVE-2024-31487
  • CVE-2024-23671
  • CVE-2023-41677
  • CVE-2023-47542
  • CVE-2023-45588
  • CVE-2024-31492
Mitigations

The enterprise should deploy this patch/workarounds as soon as the testing phase is completed.

Fortinet Security Advisory

References

Fortinet Security Advisory