Fortinet FortiOS Security Fabric Incorrect Privilege Assignment Vulnerability Allowing Privilege Escalation

A vulnerability allowing incorrect privilege assignment has been identified in Fortinet FortiOS Security Fabric. This issue affects versions 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, as well as all versions of FortiOS 7.2, 7.0, and 6.4. The vulnerability may enable a remote authenticated attacker with high privileges to escalate their privileges to super-admin by registering the device with a malicious FortiManager.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain super-admin rights.

Remediation

Users can upgrade Fortinet FortiOS Security Fabric to version 7.6.3 or above for FortiOS 7.6, and to version 7.4.8 or above for FortiOS 7.4. For FortiOS 7.2, 7.0, and 6.4, users should migrate to a fixed release. Fortinet provides an upgrade tool to assist with this process.