Fortinet Products Vulnerable to NULL Pointer Dereference via Crafted HTTP Requests
A NULL Pointer Dereference vulnerability in FortiOS, FortiProxy, and FortiPAM could allow authenticated attackers to crash the httpsd daemon.
Fortinet has disclosed a critical vulnerability, identified as a NULL Pointer Dereference (CWE-476), affecting its FortiOS, FortiProxy, and FortiPAM products. The vulnerability, detailed in advisory FG-IR-26-173, carries a CVSSv3 score of 2.5, indicating a low severity but still posing a risk to affected systems.
The vulnerability stems from an improper handling of specific HTTP requests. An authenticated attacker with network access to the vulnerable devices can exploit this flaw by sending specially crafted HTTP requests. Successful exploitation leads to a crash of the httpsd daemon, which is a crucial component responsible for handling secure web traffic on these Fortinet devices.
While the CVSS score of 2.5 suggests a low impact, the ability to crash a critical service like httpsd can lead to denial-of-service (DoS) conditions. This could disrupt network connectivity, administrative access, and other services that rely on the web interface or secure communication channels managed by the httpsd daemon. For organizations heavily reliant on these Fortinet products for their network security and management, such a disruption could have significant operational consequences.
The vulnerability requires an attacker to be authenticated to the affected system. This means that an attacker cannot exploit this flaw remotely without first gaining some level of access, such as valid user credentials. However, in environments where credentials might be compromised or shared, this precondition does not significantly limit the potential attack surface.
Fortinet has provided specific details regarding the affected products and versions in their advisory. Customers are strongly advised to consult the Fortinet PSIRT advisory FG-IR-26-173 for precise information on which versions are impacted and to apply any available patches or workarounds. The company typically releases security updates to address such vulnerabilities, and prompt patching is the most effective defense.
This discovery underscores the ongoing need for diligent security practices, even for vulnerabilities with lower CVSS scores. Regular security audits, prompt application of vendor-supplied patches, and robust access control mechanisms remain essential for maintaining a strong security posture against a wide range of threats.