FortiPortal Reboot Vulnerability

FortiPortal is a web-based interface for managing FortiGate devices. It's used by organizations to configure and monitor their firewall settings. This vulnerability allows an authenticated attacker to reboot a shared FortiGate device via crafted HTTP requests, potentially leading to Denial of Service (DoS) attacks.

Affected versions: 7.4.5 If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to FortiPortal 7.4.6 or above from the official Fortinet website:

https://support.fortinet.com/fortiguard/psirt/FG-IR-25-032

Immediate mitigations if you can't upgrade immediately:

• Restrict network access to your FortiPortal instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• Vendor Advisory