FortiOS SSLVPN Vulnerability

The FortiOS 7.0 to 6.4 all versions and FortiGate 600D series devices have a vulnerability in the SSLVPN that allows an attacker to maintain access to network resources via an active session not terminated after a user's password change under particular conditions outside of the attacker's control. This means potential unauthorized access to sensitive data, if the device is connected to the internet.

You're affected if you use An. Specific version info not stated in the advisory. If you don't recognise this software, you're probably not affected.

To fix this issue, upgrade to FortiOS 7.6 or later. If an immediate patch isn't available:

1. Restrict network access to your FortiGate instance (firewall it from the public internet).
2. Audit admin account activity for suspicious access patterns.
3. Monitor for unauthorized token creation.

For more information on upgrading, visit: https://docs.fortinet.com/upgrade-tool

• Vendor Advisory