Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager Externally-Controlled Format String Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing the use of externally-controlled format strings has been identified in multiple Fortinet products. This issue affects Fortinet FortiOS versions 7.4.0 through 7.4.1 and prior to 7.2.6, FortiProxy versions 7.4.0 and prior to 7.2.7, FortiPAM versions 1.1.2 and prior to 1.0.3, and FortiSwitchManager versions 7.2.0 through 7.2.2 and prior to 7.0.2. The vulnerability allows a privileged attacker to execute arbitrary code or commands by sending specially crafted requests.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of arbitrary code or commands on the affected system.