Fortinet FortiOS, FortiProxy, and FortiWeb Improper Privilege Management Vulnerability Granting Super-Admin Rights

A vulnerability allowing improper privilege management has been identified in Fortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and prior to 6.4.15. Additionally, Fortinet FortiProxy and Fortinet FortiWeb versions 7.6.0 through 7.6.1 and FortiWeb versions prior to 7.4.6 are affected. This vulnerability allows an authenticated attacker with at least read-only admin permissions to escalate privileges to super-admin by sending crafted requests to the Node.js websocket module.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling an attacker to gain super-admin rights.