+7For those folks who run Fortinet Devices:
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
The vulnerability has already been exploited in the wild.
CVSSv3 score is 9.3 with a rating of Critical so patch as soon as possible.
More info: PSIRT Advisories | FortiGuard
+13This is one of a hell vuln. No good at allo.
+21Read about this yesterday hopefully everyone gets patched.
+8This is a late post..but, if you cannot upgrade for some reason, you can disable 'ssl.< vdom >' interface on the device or you can disable ssl vpn # sh full-configuration vpn ssl settings | grep status # set status enable <--- change to disable (from Fortinet Support)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
