The Center for Internet Security warns that numerous vulnerabilities in Fortinet's FortiOS and related products could let attackers take control of affected systems, with organizations urged to patch promptly.
Security researchers have identified a large number of vulnerabilities in several Fortinet products used by businesses and government agencies to manage networks and security, according to the Center for Internet Security. The affected products include FortiOS, FortiManager, FortiAnalyzer, and related tools like FortiSandbox, FortiPAM, and FortiSASE.
The most serious of these flaws could allow an attacker to run malicious code, arbitrary code execution, meaning commands an attacker didn’t have permission to run, on a vulnerable system. From there, depending on the level of access, an attacker could install unauthorized programs, steal or alter data, or create new accounts with full control over the device.
This issue affects organizations that run these Fortinet products, not everyday home internet users. The Center for Internet Security rates the risk as high for government agencies and businesses of all sizes, while home users face low risk.
There are no current reports of these vulnerabilities being exploited by attackers, according to the Center for Internet Security. Still, the sheer number of flaws, spanning authentication, data handling, and network access controls, means the products involved are widely used in corporate and government networks, including firewalls and management consoles that oversee broader IT systems.
Fortinet equipment is common in small and mid-sized business networks as well as larger enterprises, so an unpatched system could give attackers a foothold into an organization’s internal operations if left unaddressed.
The Center for Internet Security recommends that organizations using these Fortinet products apply the vendor’s available software updates as soon as possible, after testing them in their own environment. The agency also advises limiting user accounts to only the access they need and keeping administrative systems separated from the rest of the network to reduce potential damage if a breach does occur.
Based on a release from Center for Internet Security.