Rewterz Threat Advisory – Multiple Fortinet Products Vulnerabilities

November 19, 2023

Severity

High

Analysis Summary

CVE-2023-36641 CVSS:6.5

Fortinet FortiOS and Fortinet FortiProxy are vulnerable to a denial of service, caused by a numeric truncation error. By sending a specially crafted HTTP request, a remote authenticated attacker could exploit this vulnerability to cause a denial of service.

CVE-2023-36633 CVSS:5.4

Fortinet FortiMail could allow a remote authenticated attacker to bypass security restrictions, caused by an improper authorization. By sending a specially crafted HTTP or HTTPS request, an attacker could exploit this vulnerability to modify the titles of other users’ address book folders.

CVE-2023-42783 CVSS:7.5

Fortinet FortiWLM could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted HTTP request to the management interface containing “dot dot” sequences (/../) to read arbitrary files on the system.

CVE-2023-26205 CVSS:8.1

Fortinet FortiADC could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper access control. By using a specially crafted configuration of fabric automation CLI script, an attacker could exploit this vulnerability to obtain administrative privileges.

CVE-2023-36553 CVSS:9.8

Fortinet FortiSIEM could allow a remote attacker to execute arbitrary commands on the system, caused by an OS command injection vulnerability. By sending specially crafted API requests, an attacker could exploit this vulnerability to execute arbitrary commands on the system.

CVE-2023-45585 CVSS:2.3

Fortinet FortiSIEM could allow a local authenticated attacker to obtain sensitive information, caused by insertion of sensitive information into log files. An attacker could exploit this vulnerability to obtain encrypted ElasticSearch passwords from debug log files generated when FortiSIEM is configured with ElasticSearch Event Storage and use this information to launch further attacks against the affected system.

CVE-2023-28002 CVSS:6.4

Fortinet FortiOS and Fortinet FortiProxy could allow a local authenticated attacker to bypass security restrictions, caused by improper validation of integrity check values. An attacker could exploit this vulnerability to boot a malicious image on the device and bypass the filesystem integrity check in place.

CVE-2023-45582 CVSS:5.6

Fortinet FortiMail is vulnerable to a brute force attack, caused by improper restriction of excessive authentication attempts. By using brute force techniques, a remote attacker could exploit this vulnerability to gain access to the system.

CVE-2023-33304 CVSS:4.4

Fortinet FortiClient for Windows could allow a local authenticated attacker to bypass security restrictions, caused by use of hard-coded credentials in vcm2.exe. An attacker could exploit this vulnerability to bypass system protections.

CVE-2023-41676 CVSS:4.3

Fortinet FortiSIEM could allow a remote authenticated attacker to obtain sensitive information. By searching through the logs, a remote attacker could exploit this vulnerability to obtain the windows agent password.