PT-2023-8535 · Fortinet · Fortios
CVE-2023-47537
·
Publicado
2023-11-06
·
Atualizado
2024-05-21
CVSS v3.1
4.8
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
FortiOS versions 6.4 through 7.0.13
FortiOS versions 7.2.0 through 7.2.6
FortiOS versions 7.4.0 through 7.4.1
Description
The issue is related to an improper certificate validation procedure in the FortiLink protocol implementation, allowing a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the FortiOS device and FortiSwitch. This could enable the attacker to decipher and alter the communication.
Recommendations
For FortiOS versions 6.4 through 7.0.13, update to a version that includes the fix for the improper certificate validation vulnerability.
For FortiOS versions 7.2.0 through 7.2.6, update to a version that includes the fix for the improper certificate validation vulnerability.
For FortiOS versions 7.4.0 through 7.4.1, update to a version that includes the fix for the improper certificate validation vulnerability.
As a temporary workaround, consider restricting access to the FortiLink communication channel to minimize the risk of exploitation.
Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Fortios