Fortinet Product Security Update Advisory

Jun 12 2024

Overview

An update has been made available to fix vulnerabilities in the Fortinet family of products. Users of affected versions are advised to update to the latest version.

Affected Products

CVE-2024-23110

FortiOS Versions: 7.4.0 (inclusive) to 7.4.2 (inclusive)
FortiOS Versions : 7.2.0 (inclusive) to 7.2.6 (inclusive)
FortiOS versions : 7.0.0 (inclusive) to 7.0.13 (inclusive)
FortiOS versions : 6.4.0 (inclusive) to 6.4.14 (inclusive)
FortiOS versions : 6.2.0 (inclusive) to 6.2.15 (inclusive)
FortiOS version: all versions of 6.0

CVE-2024-26010

FortiOS Versions: 7.4.0 (inclusive) through 7.4.3 (inclusive)
FortiOS Versions: 7.2.0 (inclusive) through 7.2.7 (inclusive)
FortiOS versions : 7.0.0 (inclusive) to 7.0.14 (inclusive)
FortiOS versions: all versions of 6.4
FortiOS version : all versions of 6.2
FortiOS version: all versions of 6.0
FortiPAM version: all versions of 1.2
FortiPAM version: all versions of 1.1
FortiPAM version: all versions of 1.0
FortiProxy version: 7.4.0 (inclusive) to 7.4.3 (inclusive)
FortiProxy versions: 7.2.0 (inclusive) to 7.2.9 (inclusive)
FortiProxy version: all versions of 2.0
FortiProxy versions: all versions of 1.2
FortiProxy versions: all versions of 1.1
FortiProxy version: all versions of 1.0
FortiSwitchManager versions: 7.2.0 (inclusive) through 7.2.3 (inclusive)
FortiSwitchManager versions: 7.0.1 (inclusive) to 7.0.3 (inclusive)

CVE-2024-23111

FortiOS Versions: 7.4.0 (inclusive) to 7.4.3 (inclusive)
FortiOS Versions: 7.2.0 (inclusive) to 7.2.7 (inclusive)
FortiOS versions : 7.0.0 (inclusive) to 7.0.13 (inclusive)
FortiOS version: all versions of 6.4
FortiProxy versions: 7.4.0 (inclusive) to 7.4.2 (inclusive)
FortiProxy versions: 7.2.0 (inclusive) to 7.2.8 (inclusive)
FortiProxy versions : 7.0.0 (inclusive) to 7.0.14 (inclusive)
FortiProxy version: all versions of 2.0

CVE-2023-46720

FortiOS versions: 7.4.0 (inclusive) to 7.4.1 (inclusive)
FortiOS versions: 7.2.0 (inclusive) through 7.2.7 (inclusive)
FortiOS versions : 7.0.0 (inclusive) to 7.0.12 (inclusive)
FortiOS versions : 6.4.6 (inclusive) to 6.4.15 (inclusive)
FortiOS versions : 6.2.9 (inclusive) to 6.2.16 (inclusive)
FortiOS versions: 6.0.13 (inclusive) to 6.0.18 (inclusive)

CVE-2024-21754

FortiOS Versions: 7.4.0 (inclusive) to 7.4.3 (inclusive)
FortiOS version: all versions of 7.2
FortiOS Versions: all versions of 7.0
FortiOS version: all versions of 6.4
FortiProxy versions: 7.4.0 (inclusive) to 7.4.2 (inclusive)
FortiProxy version: all versions of 7.2
FortiProxy versions: all versions of 7.0
FortiProxy versions: all versions of 2.0

Resolved Vulnerabilities

Multiple Buffer Overflow Vulnerability in the diag npu command in FortiOS (CVE-2024-23110) [1][2]

Stack Buffer Overflow Vulnerability in FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager (CVE-2024-26010) [3][4]

XSS Vulnerability in FortiOS and FortiProxy (CVE-2024-23111) [5][6]

Stack Buffer Overflow Vulnerability in FortiOS (CVE-2023-46720) [7][8]

Improper access control vulnerability in FortiOS and FortiProxy that could allow backup files to be decrypted due to insufficient hashed passwords (CVE-2024-21754) [9][10]

Vulnerability Patches

Vulnerability patches have been made available in the latest updates. Please follow the instructions on the referenced sites to update to the latest vulnerability patched version.

CVE-2024-23110