Fortinet Warns of New Auth Bypass Flaw Affecting FortiGate and FortiProxy

Fortinet has privately warned its customers of a security flaw
affecting FortiGate firewalls and FortiProxy web proxies that could
potentially allow an attacker to perform unauthorized actions on
susceptible devices.

Tracked as CVE-2022-40684, the high-severity
flaw relates to an authentication bypass
vulnerability^[1]
that could permit an unauthenticated adversary to perform arbitrary
operations on the administrative interface.

The issue impacts the following versions, and has been addressed
in FortiOS versions 7.0.7^[2]
and 7.2.2^[3], and FortiProxy version
7.0.7^[4]
released this week –

• FortiOS – From 7.0.0 to 7.0.6 and from 7.2.0 to 7.2.1
• FortiProxy – From 7.0.0 to 7.0.6 and 7.2.0

“Due to the ability to exploit this issue remotely, Fortinet is
strongly recommending all customers with the vulnerable versions to
perform an immediate upgrade,” the company cautioned^[5]
in an alert shared by a security researcher named Gitworm on
Twitter.

When reached for a comment, Fortinet acknowledged the advisory
and noted that it’s delaying public notice until its customers have
applied the fixes.

“Timely and ongoing communications with our customers is a key
component in our efforts to best protect and secure their
organization,” the company said in a statement shared with The
Hacker News. “Customer communications often detail the most
up-to-date guidance and recommended next steps to best protect and
secure their organization.”

“There are instances where confidential advance customer
communications can include early warning on advisories to enable
customers to further strengthen their security posture, which then
will be publicly released in the coming days to a broader audience.
The security of our customers is our first priority.”