Flash Notice: High-Severity Fortinet Vulnerabilities Impact FortiTester and FortiADC

overview

Two high-severity vulnerabilities were found in Fortinet’s FortiADC and FortiTester. According to Fortinet’s advisory, CVE-2022-39947 impacts FortiADC and may allow an authenticated attacker with access to the web GUI to execute unauthorized code or commands via specifically crafted HTTP requests. CVE-2022-35845 impacts FortiTester and is a collection of command injection flaws.  

CVE-2022-39947 has a CVSS score of 8.6. The flaw was located in the FortiADC web interface and could lead to arbitrary code execution. The following versions of FortiADC are impacted:  

• 5.4.x1 
• 6.0.x 
• 6.1.x 
• 6.2.x 
• 7.0.x 

CVE-2022-35845 is a collection of flaws in FortiTester and has a CVSS score of 7.6. Fortinet describes them as improper neutralization of special elements used in an OS Command (‘OS Command Injection) vulnerabilities [CWE-78] that may allow an unauthenticated attacker to execute arbitrary commands in the underlying shell. The following FortiTester products are impacted:  

• FortiTester version 7.1.0 
• FortiTester version 7.0 all versions 
• FortiTester version 4.0.0 through 4.2.0 
• FortiTester version 2.3.0 through 3.9.1 

Fortinet has fixed the above vulnerabilities and highly recommends that users upgrade to the following FortiADC versions:  

• FortiADC 7.0.2 or above 
• FortiADC 6.2.4 or above 
• Upcoming FortiADC 5.4.6 or above 

Fortinet also recommends that users upgrade to the following FortiTester versions:  

• FortiTester version 7.2.0 or above 
• FortiTester version 7.1.1 or above 
• FortiTester version 4.2.1 or above 
• FortiTester version 3.9.2 or above 

Avertium's recommendations    

Avertium recommends that users of FortiADC and FortiTester upgrade to the recommended versions.  

• You can find patch guidance for CVE-2022-39947 here.  
• You can find patch guidance for CVE-2022-35845 here. 

indicators of compromise (ioCs)  

At this time, there are no known IoCs associated with CVE-2022-39947 and CVE-2022-35845. Avertium’s threat hunters remain vigilant in locating IoCs for our customers. Should any be located, Avertium will disclose them as soon as possible. For more information on how Avertium can help protect your organization, please reach out to your Avertium Service Delivery Manager or Account Executive.    

How Avertium is Protecting Our CUSTOMERS

• Fusion MXDR is the first MDR offering that fuses together all aspects of security operations into a living, breathing, threat-resistant XDR solution. By fusing insights from threat intelligence, security assessments, and vulnerability management into our MDR approach, Fusion MXDR offers a more informed, robust, and cost-effective approach to cybersecurity – one that is greater than the sum of its parts. 
• Avertium offers VMaaS to provide a deeper understanding and control over organizational information security risks.  If your enterprise is facing challenges with the scope, resources, or skills required to implement a vulnerability management program with your team, outsourced solutions can help you bridge the gap.  
• Minimizing the impact of a successful ransomware attack requires detecting it as early in the attack as possible. A Security Information and Event Management (SIEM) system can help an organization to accomplish this. Avertium offers a comprehensive SIEM-based approach that increases the potential for detecting a ransomware infection before it deploys. SIEM provides a holistic overview of a company’s IT environment from a single point of view in terms of its specific security events, empowering teams to detect and analyze unusual behavior.