Attackers could attack Fortinet protection software due to several security holes and, in the worst case, execute their own commands. Secure versions are available for download.

FortiDeceptor is affected, among others. With the protection solution, you can set traps for attackers in networks and, in the best case, detect threats early.

The most dangerous is one with the threat level ” high “classified vulnerability (CVE – 2020 – 29017) in FortiDeceptor. According to a warning message, a remote attacker would need to be authenticated for a successful attack. If this is the case, he could start at the customization page in a way that is not described in detail and execute his own commands in the system.

In contrast, the versions FortiDeceptor 3.0.2 , 3.1.1 and 3.2.0 . All previous editions are under threat, according to Fortinet.

Other vulnerabilities FortiWeb is vulnerable to four vulnerabilities (CVE- 2020 – 29015 , CVE – 2020 – 29016, CVE – 2020 – 29018, CVE – 2020 – 29019) vulnerable. All gaps are classified as ” medium “. If attacks are successful, attackers could paralyze systems via DoS attacks or even execute malicious code. Fortinet provides further information on possible attacks in the security warnings linked below this message.

Admins should ensure that they are using the patched versions FortiWeb 6.2.4 , 6.3.6 or 6.3.8 installed.

Another loophole with the threat level ” medium ” (CVE – 2020 – 2020) concerns FortiGate SSL VPN. Here remote authenticated attackers could access log entries and see, for example, IP addresses and user names.

To prevent this, the developers have the versions FortiGate 6.0. 11 , 6.2.5 and 6.4.2 published.

List sorted in descending order by threat level:

FortiDeceptor is impacted by an OS command injection vulnerability FortiWeb is vulnerable to a blind SQL injection Stack-Based Buffer Overflow vulnerability in FortiWeb FortiWeb is vulnerable to a buffer overflow FortiWeb is vulnerable to a Format string vulnerability FortiGate SSL VPN logs may display events of users in a different VDOM (of)