H-ISAC Threat Bulletin: TLP WHITE: A Critical FortiSIEM Flaw Was Disclosed with Exploit Code Available

The flaw exists due to improper neutralization of special elements used in an OS command in FortiSIEM devices. In the event of successful exploitation, the flaw could allow threat actors to execute unauthorized code via crafted CLI requests. The flaw has a CVSS score of 9.8, highlighting its criticality.

Affected FortiSIEM versions are as follows:

• FortiSIEM 7.3: Versions 7.3.0 – 7.3.1
• FortiSIEM 7.2: Versions 7.2.0 – 7.2.5
• FortiSIEM 7.1: Versions 7.1.0 – 7.1.7
• FortiSIEM 7.0: Versions 7.0.0 – 7.0.3
• FortiSIEM 6.7: Versions 6.7.0 – 6.7.9
• All versions of 6.6, 6.5, 6.4, 6.3, 6.2, 6.1, and 5.4

Patches are available for vulnerable versions, and immediate patching is strongly recommended since the existence of exploit code increases the likelihood of attacks.

For organizations that are currently unable to apply patches, a temporary workaround is to limit access to the phMonitor port (7900).