Fortinet has privately warned its customers of a security flaw affecting FortiGate firewalls and FortiProxy web proxies that could potentially allow an attacker to perform unauthorized actions on susceptible devices.
Tracked as CVE-2022-40684 (CVSS score: 9.6), the critical flaw relates to an authentication bypass vulnerability that may permit an unauthenticated adversary to carry out arbitrary operations on the administrative interface via a specially crafted HTTP(S) request.
The issue impacts the following versions, and has been addressed in FortiOS versions 7.0.7 and 7.2.2, and FortiProxy versions 7.0.7 and 7.2.1 released this week:
- FortiOS - From 7.0.0 to 7.0.6 and from 7.2.0 to 7.2.1
- FortiProxy - From 7.0.0 to 7.0.6 and 7.2.0
"Due to the ability to exploit this issue remotely, Fortinet is strongly recommending all customers with the vulnerable versions to perform an immediate upgrade," the company cautioned in an alert shared by a security researcher who goes by the alias Gitworm on Twitter.
As temporary workarounds, the company is recommending users to disable internet-facing HTTPS Administration until the upgrades can be put in place, or alternatively, enforce a firewall policy to "local-in traffic."
When reached for a comment, Fortinet acknowledged the advisory and noted that it's delaying public notice until its customers have applied the fixes.
"Timely and ongoing communications with our customers is a key component in our efforts to best protect and secure their organization," the company said in a statement shared with The Hacker News. "Customer communications often detail the most up-to-date guidance and recommended next steps to best protect and secure their organization."
"There are instances where confidential advance customer communications can include early warning on advisories to enable customers to further strengthen their security posture, which then will be publicly released in the coming days to a broader audience. The security of our customers is our first priority."
