PSIRT Advisories

Monthly PSIRT Advisories

The following is a list of advisories for issues resolved in Fortinet products. The resolution of such issues is coordinated by the Fortinet Product Security Incident Response Team (PSIRT), a dedicated, global team that manages the receipt, investigation, and public reporting of information about security vulnerabilities and issues related to Fortinet products and services.  

For details of how to raise a PSIRT Issue with Fortinet, please see our PSIRT Policy here.

Use of a hard-coded cryptographic key to encrypt password data in CLI configuration in FortiOS, FortiManager and FortiAnal...

FortiAnalyzer 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.11, 6.0.10, 6.0.1, 6.0.0 FortiOS 6.2.0, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.10, 5.6.1, 5.6.0, 5.4.9, 5.4.8, 5.4.7, 5.4.6, 5.4.5, 5.4.4, 5.4.3, 5.4.2, 5.4.13, 5.4.12, 5.4.11, 5.4.10, 5.4.1 FortiManager 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.9, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.11, 6.0.10, 6.0.1, 6.0.0
Jun 30, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-19-007 CVE-2020-9289
An improper access control vulnerability in the admin SSH console of multiple products may allow an authenticated user to ...

FortiManager 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiWAN 4.5.7, 4.5.6, 4.5.5, 4.5.4, 4.5.3, 4.5.2, 4.5.1, 4.5.0 FortiADCManager 5.3.0 FortiAnalyzer 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiADC 5.3.4, 5.2.5 FortiAP-C 5.4.2 FortiDDoS 5.2.0 FortiExtender 4.2.0 FortiWLC 8.5.5, 8.5.4, 8.5.3, 8.5.2, 8.5.1 FortiPortal 5.3.2, 5.2.4 FortiDDoS-CM 5.2.0
Jun 26, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-19-292 CVE-2004-1653
An OS command injection vulnerability in FortiAnalyzer, FortiAuthenticator and FortiManager may allow a privileged system ...

FortiAuthenticator 6.1.2, 6.1.1, 6.1.0 FortiManager 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0 FortiAnalyzer 6.2.3, 6.2.2, 6.2.1, 6.2.0, 6.0.8, 6.0.7, 6.0.6, 6.0.5, 6.0.4, 6.0.3, 6.0.2, 6.0.1, 6.0.0, 5.6.9, 5.6.8, 5.6.7, 5.6.6, 5.6.5, 5.6.4, 5.6.3, 5.6.2, 5.6.11, 5.6.10, 5.6.1, 5.6.0
Jun 26, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-19-294 CVE-2019-9193
An insufficient control of network message volume (CWE-406) vulnerability in FortiAnalyzer may allow an unauthenticated re...

FortiAnalyzer 6.4.0, 6.2.3 FortiRecorder 6.0.1, 6.0.0, 2.7.7
Jun 22, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-036 CVE-2013-5211
An insufficient session expiration vulnerability in FortiDeceptor may allow an attacker to reuse the unexpired admin user ...

FortiDeceptor 3.0.2, 3.0.1, 3.0.0
Jun 21, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-006 CVE-2020-6644
An expression language injection vulnerability in FortiSIEM JBoss RichFaces library may allow a remote attacker to inject ...

FortiSIEM 5.2.8, 5.2.6
Jun 21, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-041 CVE-2015-0279
An improper neutralization of input vulnerability in FortiWLC may allow a remote authenticated attacker to perform a store...

FortiWLC 8.5.1
Jun 21, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-016 CVE-2020-9288
An improper neutralization of input vulnerability in the Admin Profile of FortiAnalyzer may allow a remote authenticated a...

FortiAnalyzer 6.2.3, 6.2.2
Jun 03, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-003 CVE-2020-6640
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated pri...

FortiSIEMWindowsAgent 3.1.3, 3.1.2
Jun 03, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Medium IR Number: FG-IR-20-021 CVE-2020-9292
Use of a hard-coded cryptographic key to encrypt security sensitive data in configuration in FortiClient for Windows may a...

FortiClientWindows 6.2.9, 6.2.8, 6.2.7, 6.2.6
Jun 01, 2020 Severity light-circle-logo light-circle-logo light-circle-logo light-circle-logo light-circle-logo Low IR Number: FG-IR-19-194 CVE-2019-16150