Fortinet FortiPAM and FortiSwitchManager Weak Authentication Vulnerability Allowing Unauthorized Code Execution

A weak authentication vulnerability has been identified in Fortinet FortiPAM versions 1.5.0, 1.4.0 through 1.4.2, 1.3.0 through 1.3.1, 1.2.0, 1.1.0 through 1.1.2, and FortiSwitchManager versions 7.2.0 through 7.2.4. This vulnerability allows attackers to execute unauthorized code or commands by sending specially crafted HTTP requests. The issue arises from the WAD/GUI component, where the authentication process can be bypassed, potentially through brute-force attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized code execution or command execution on the affected system.

Remediation

Users of Fortinet FortiPAM should upgrade to version 1.5.1 or above. Fortinet FortiSwitchManager users should upgrade to version 7.2.5 or above.