Description
An improper neutralization of input during web page Generation vulnerability [CWE-79] in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote unauthenticated attacker to perform a Cross-Site Scripting attack via a malicious samba server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiProxy | 7.4.0 – ≤ 7.4.3, 7.2.0 – ≤ 7.2.9, 7.0.0 – ≤ 7.0.16 | — |
| Fortinet | FortiOS | 7.4.0 – ≤ 7.4.3, 7.2.0 – ≤ 7.2.7, 7.0.0 – ≤ 7.0.13, 6.4.0 – ≤ 6.4.15 | — |
Advisories 3
- ICSA-24-193-02 Siemens RUGGEDCOM APE 1808 CISA ICS & IT advisories · Jan 14, 2026
- SSA-698820 SSA-698820: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.4 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Jan 13, 2026
- WID-SEC-2024-1570 Fortinet FortiOS und FortiProxy: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 9, 2024