Fortinet FortiOS IPSec VPN Origin Validation Error Vulnerability Allowing IP Spoofing

A vulnerability allowing IP spoofing has been identified in Fortinet FortiOS IPSec VPN versions 7.4.0 through 7.4.1 and in version 7.2.6 and below. This origin validation error allows an authenticated IPSec VPN user with dynamic IP addressing to send packets that impersonate the IP of another user, using specially crafted network packets. However, the vulnerability does not allow the spoofed packets to be received by the targeted user.

Impact

Exploitation of this vulnerability allows for IP spoofing, where an authenticated user can send packets that appear to come from another user's IP address.