Fortinet Products Heap-Based Buffer Overflow Vulnerability Allowing Arbitrary Code Execution

A heap-based buffer overflow vulnerability has been identified in multiple Fortinet products, including FortiOS, FortiManager, FortiAnalyzer, FortiManager Cloud, FortiAnalyzer Cloud, and FortiProxy. This vulnerability affects several different versions and ranges within these products. The issue allows an authenticated attacker to execute unauthorized code or commands by sending specially crafted requests.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code or commands on the affected system.

Remediation

Users are advised to upgrade to the latest versions of the affected Fortinet products. Specific upgrade recommendations vary by product and version, with some users needing to migrate to a fixed release. Detailed upgrade paths can be found using Fortinet's upgrade tool.