Description
A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.
Metrics
CVSS 3.1 5.9/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiOS | >= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.7; >= 7.0.0, <= 7.0.14; >= 6.4.2, <= 6.4.16 |
| Fortinet | FortiProxy | >= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.16 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-058Vendor Advisory
Timeline
- Published
- Jun 10, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed