Description
A use after free vulnerability [CWE-416] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching proxy policies or firewall policies with proxy mode alongside SSL deep packet inspection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.2.0 – ≤ 7.2.4, 7.0.0 – ≤ 7.0.10 | — |
| Fortinet | FortiProxy | 7.2.0 – ≤ 7.2.2, 7.0.0 – ≤ 7.0.8 | — |
Advisories 3
- ICSA-24-074-11 Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices CISA ICS & IT advisories · Jan 14, 2026
- SSA-366067 SSA-366067: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026
- WID-SEC-2023-2616 Fortinet FortiOS: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Oct 10, 2023