Description
An insufficient verification of data authenticity vulnerability [CWE-345] in Fortinet FortiOS SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.12 & FortiProxy SSL-VPN tunnel mode version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 allows an authenticated VPN user to send (but not receive) packets spoofing the IP of another user via crafted network packets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiProxy | 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.7, 7.0.0 – ≤ 7.0.13, 2.0.0 – ≤ 2.0.14 | — |
| Fortinet | FortiOS | 7.4.0 – ≤ 7.4.1, 7.2.0 – ≤ 7.2.7, 7.0.0 – ≤ 7.0.12, 6.4.0 – ≤ 6.4.15, 6.2.0 – ≤ 6.2.16 | — |
Advisories 4
- ICSA-24-074-05 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Jan 14, 2026
- SSA-832273 SSA-832273: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.3 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026
- NCSC-2024-0222 Kwetsbaarheden verholpen in Fortinet FortiOS NCSC-NL (Netherlands) · May 16, 2024
- WID-SEC-2024-1148 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 14, 2024