What happened
Multiple Fortinet products, including FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager, have been found to contain a path traversal vulnerability. This flaw allows an attacker with an authenticated admin profile and at least read-write permissions to write or delete arbitrary files on affected systems by executing specific CLI commands. The vulnerability has been actively exploited in the wild, indicating its seriousness and the urgency of remediation efforts. The weakness is associated with CWE-22, which indicates directory traversal issues that can be leveraged to access files outside the intended directories. The exploitation path involves an attacker exploiting the misconfigured or vulnerable CLI command interface to escalate their access and manipulate files within the product environment. The vulnerability impacts systems running the affected Fortinet products, especially where administrative access is already authenticated. According to authoritative reports, this flaw has been confirmed to be exploited actively, underlining the need for prompt action. Mitigations outlined by the vendor include applying required patches or configuration changes per vendor instructions. Should mitigation be unavailable, discontinuation of the product may be necessary in accordance with guidance on prioritising security updates based on risk, as specified by CISA.
Who is affected
Organisations running affected Fortinet products, specifically FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager, are impacted by this vulnerability. Any deployment with an administrative profile that possesses at least read-write permissions—and where CLI commands can be executed—may be susceptible to exploitation. The vulnerability's impact is heightened where systems are exposed to the internet or insecure networks, increasing the risk of malicious activity. Entities responsible for these deployments must evaluate their exposure and ensure that appropriate security controls and patches are applied according to vendor guidance. Employing security best practices, such as segregating management access and enforcing least privilege, can mitigate segments of the threat.
Recommended actions
- Affected organizations should apply mitigations in accordance with vendor instructions to address the path traversal vulnerability. This includes implementing all recommended configuration changes and patches as soon as they become available. If mitigations cannot be applied promptly, discontinuing use of the affected products should be considered, especially in internet-facing deployments or where control over access is limited.
- Organizations must review their internet exposure and conform to CISA’s BOD 26-04 guidance for prioritising security updates based on risk. Ensuring that administrative access is secured and monitored reduces the likelihood of exploitation. The urgency of these measures is reinforced by the active exploitation in the wild and the critical severity assigned to this vulnerability.
