Fortinet FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice and FortiWeb Improper Restriction of Communication Channel Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability allowing improper restriction of communication channels to intended endpoints has been identified in multiple Fortinet products, including FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice, and FortiWeb. This vulnerability affects several different versions and ranges across these products, allowing an unauthenticated attacker in a man-in-the-middle position to intercept and impersonate the management device, such as FortiCloud server or FortiManager, by intercepting the FGFM authentication request between the management device and the managed device.

Impact

Exploitation of this vulnerability allows for man-in-the-middle attacks, where an attacker can intercept and manipulate communications between the management device and the managed device, potentially leading to unauthorized access or control.