Fortinet FortiAnalyzer Improper Authentication Vulnerability in OFTP Service Allowing Information Disclosure and Denial-of-Service

A vulnerability allowing improper authentication has been identified in Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 and prior to 7.4.6. This vulnerability allows an unauthenticated attacker to access information related to the device's health and status or to cause a denial-of-service condition by sending crafted OFTP requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access to device health and status information or cause a denial-of-service condition on the affected device.

Remediation

Users of Fortinet FortiAnalyzer should upgrade to version 7.6.4 or above if they are using FortiAnalyzer 7.6, or to version 7.4.7 or above if they are using FortiAnalyzer 7.4. For those on FortiAnalyzer 7.2, 7.0, or 6.4, migration to a fixed release is recommended.