Fortinet has released security updates to address a vulnerability in the following products:

• FortiADC 5.0 all versions
• FortiADC 5.1 all versions
• FortiADC 5.2 all versions
• FortiADC 5.3 all versions
• FortiADC 5.4 all versions
• FortiADC 6.0 all versions
• FortiADC 6.1 all versions
• FortiADC version 6.2.0 through 6.2.2
• FortiADC version 7.0.0 through 7.0.2
• FortiExtender 3.0 all versions
• FortiExtender 3.1 all versions
• FortiExtender 5.3 all versions
• FortiExtender version 3.2.1 through 3.2.3
• FortiExtender version 3.3.0 through 3.3.2
• FortiExtender version 4.0.0 through 4.0.2
• FortiExtender version 4.1.1 through 4.1.8
• FortiExtender version 4.2.0 through 4.2.4
• FortiExtender version 7.0.0 through 7.0.3
• FortiNAC 8.8, 8.7, 8.6, 8.5, 8.3 all versions
• FortiNAC version 9.1.0 through 9.1.7
• FortiNAC version 9.2.0 through 9.2.5
• FortiNAC version 9.2.0 through 9.2.6
• FortiNAC version 9.4.0 through 9.4.1
• FortiOS version 6.2.0 through 6.2.12
• FortiOS version 6.4.0 through 6.4.10
• FortiOS version 7.0.0 through 7.0.7
• FortiOS version 7.0.0 through 7.0.8
• FortiOS version 7.2.0 through 7.2.2
• FortiOS version 7.2.0 through 7.2.3
• FortiProxy version 1.1 all versions
• FortiProxy version 1.2 all versions
• FortiProxy version 2.0.0 through 2.0.11
• FortiProxy version 7.0.0 through 7.0.7
• FortiProxy version 7.2.0 through 7.2.1
• FortiSwitchManager version 7.0.0
• FortiSwitchManager version 7.2.0
• FortiWAN version 4.0.0 through 4.0.6
• FortiWAN version 4.1.1 through 4.1.3
• FortiWAN version 4.2.1 through 4.2.2
• FortiWAN version 4.2.5 through 4.2.7
• FortiWAN version 4.3.0 through 4.3.1
• FortiWAN version 4.4.0 through 4.4.1
• FortiWAN version 4.5.0 through 4.5.9
• FortiWeb 5.6 all versions
• FortiWeb 5.7 all versions
• FortiWeb 5.8 all versions
• FortiWeb 6.0 all versions
• FortiWeb 6.1 all versions
• FortiWeb 6.2 all versions
• FortiWeb 6.4 all versions
• FortiWeb version 6.3.0 through 6.3.19
• FortiWeb version 6.3.6 through 6.3.18
• FortiWeb version 6.3.6 through 6.3.19
• FortiWeb version 7.0.0 through 7.0.1
• FortiWeb version 7.0.0 through 7.0.3
• FortiWeb versions 5.9.1 and below
• FortiWeb versions 5.x all versions
• FortiWeb versions 6.0.7 and below
• FortiWeb versions 6.1.2 and below
• FortiWeb versions 6.2.6 and below
• FortiWeb versions 6.3.17 and below
• FortiWeb versions 6.4 all versions

The above vulnerabilities can be exploited to perform the following:

• Command injection to perform authenticated remote code execution.
• Arbitrary Code Execution
• Insufficiently protected credentials allow for password recovery
• Cross Site scripting (XSS)
• Path traversal vulnerability that leads to read/write on the OS
• Buffer overflow that leads to arbitrary code execution
• Improper authorization
• Session fixation

The CERT team encourages users to review Fortinet security advisory and apply the necessary updates:

https://www.fortiguard.com/psirt