Description
An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization packets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiOS | 7.6.0, 7.4.0 – ≤ 7.4.5, 7.2.0 – ≤ 7.2.11, 7.0.0 – ≤ 7.0.17, 6.4.0 – ≤ 6.4.16 | — |
Advisories 4
- ICSA-25-044-06 Siemens RUGGEDCOM APE1808 CISA ICS & IT advisories · Mar 12, 2026
- SSA-770770 SSA-770770: Multiple Vulnerabilities in Fortigate NGFW Before V7.4.7 on RUGGEDCOM APE1808 Devices Siemens ProductCERT · Mar 10, 2026
- NCSC-2025-0192 Kwetsbaarheden verholpen in Fortinet FortiOS NCSC-NL (Netherlands) · Jun 12, 2025
- WID-SEC-2025-1283 Fortinet FortiOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 10, 2025