Fortinet Products: Multiple Vulnerabilities
A BSI Warn- und Informationsdienst (WID): Schwachstellen-Informationen (Security Advisories) ·
Admiralty grading (A–F · 1–6)
Source reliability
- A Completely reliable
- B Usually reliable
- C Fairly reliable
- D Not usually reliable
- E Unreliable
- F Cannot be judged
Information credibility
- 1 Confirmed
- 2 Probably true
- 3 Possibly true
- 4 Doubtful
- 5 Improbable
- 6 Cannot be judged
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
Key insight
The BSI aggregate advisory lists neither CVE IDs nor CVSS scores, so operators of FortiGate and FortiClient installations must resolve severity and exposure via the Fortinet PSIRT advisories.
Description
The BSI reports multiple vulnerabilities in the Fortinet products FortiManager, FortiOS, FortiMail, FortiClient and FortiAnalyzer. According to the advisory, a remote, anonymous attacker can exploit these to execute arbitrary code, escalate privileges, bypass security mechanisms, cause a denial of service, and disclose or manipulate data. The advisory contains no CVE IDs and no CVSS scores, so the severity and affectedness of the individual flaws cannot be derived directly from it. Typical attack surfaces are exposed management, VPN and administrative web interfaces of the listed products. The advisory contains no indication of active exploitation or inclusion in the CISA KEV list.
Risk score
- cvss base
- 0.00
- kev bonus
- 0.00
- epss bonus
- 0.00
- poc bonus
- 0.00
- raw before weight
- 0.00
- industry weight
- 1.21
- freshness factor
- 1.00
- exploitability factor
- 1.00
- days old
- 0.00
- vendor mismatch penalty
- 0.00
Path: operational