Fortinet released security updates to address vulnerabilities in multiple Fortinet products. These updates include various Fortinet products including FortiGate Firewall, FortiManager, FortiAnalyzer, FortiClient, and others.

The advisory will focus on the below Fortinet Products;

• FortiClientEMS – CSV injection in log download feature
• FortiOS, FortiProxy – Out-of-bounds Write in captive portal
• FortiOS, FortiProxy – Authorization bypass in SSLVPN bookmarks
• FortiWLM MEA for FortiManager – Improper access control in backup and restore features
• Prevasive SQL injection in DNS component

The following Fortinet Products are affected;

• FortiClientEMS 7.0 / FortiClientEMS 7.2
• FortiOS versions
• FortiProxy versions
• FortiManager versions
• FortiClient EMS

The vulnerabilities may allow a cyber threat actor to exploit some of these vulnerabilities to take control of an affected system.

CERTVU strongly encourages administrators to review the following advisories and apply necessary security updates for Fortinet products and versions.