Fortinet FortiOS and FortiProxy Identity Spoofing Vulnerability in Security Fabric

A vulnerability allowing identity spoofing of downstream devices in the security fabric has been identified in Fortinet FortiOS versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, and prior to 7.0.14. Fortinet FortiProxy versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.9, and prior to 7.0.16 are also affected. This vulnerability, accessible to unauthenticated attackers who possess knowledge of device-specific data, involves spoofing the identity of a downstream device by sending crafted TCP requests.

Impact

Exploitation of this vulnerability allows for unauthorized identity spoofing of devices within the security fabric, potentially leading to misrepresentation of device status or capabilities.