Alert GCSA-25114 - Vulnerabilita' multiple nei prodotti Fortinet
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ****************************************************************** Alert ID: GCSA-25114 Data: 15 Ottobre 2025 Titolo: Vulnerabilita' multiple nei prodotti Fortinet ****************************************************************** :: Descrizione del problema Fortinet ha rilasciato degli aggiornamenti per risolvere varie vulnerabilita' presenti nei suoi prodotti: FG-IR-25-756 Authenticated Heap Overflow in SSL-VPN bookmarks FG-IR-24-372 Domain fronting protection bypass in explicit web proxy FG-IR-24-041 FGFM protocol allows unauthenticated reset of the connection FG-IR-24-442 Heap Overflow in fgfmsd FG-IR-24-546 Heap buffer overflow in websocket FG-IR-25-684 Improper autorization over static files FG-IR-24-452 Insertion of Sensitive 2FA Information in logs and debug command FG-IR-24-228 Insertion of Sensitive Information Into Sent Data Vulnerability in csfd daemon FG-IR-24-487 Insufficient Session Expiration in SSLVPN using SAML authentication FG-IR-25-378 Missing authentication check in OFTP service FG-IR-25-653 Multiple Unchecked Return Value leading to Null Pointer Dereference FG-IR-24-542 Open Redirect and XSS in Web Filter warning page FG-IR-25-198 Race condion in FortiCloud SSO SAML authentication FG-IR-24-361 Restricted CLI command bypass FG-IR-23-354 Stack-based buffer overflow on fortitoken import feature FG-IR-25-010 Weak authentication in WAD/GUI FG-IR-24-457 ZTNA Server Improper Certificate Validation FG-IR-25-198 Race condion in FortiCloud SSO SAML authentication FG-IR-25-037 Code injection in login window FG-IR-25-126 Missing signature verification for FortiClient.app FG-IR-25-664 Local Privilege Escalation in LaunchDaemon FG-IR-25-685 DLL hijacking in online installer Maggiori informazioni sono disponibili alla sezione "Riferimenti". :: Software interessato FortiOS 6.0 tutte le versioni FortiOS 6.2 tutte le versioni FortiOS 6.4 tutte le versioni FortiOS 7.0 tutte le versioni FortiOS 7.2 tutte le versioni FortiOS 7.4 versioni dalla 7.4.0 alla 7.4.8 FortiOS 7.6 versioni dalla 7.6.0 alla 7.6.3 FortiPAM 1.0 tutte le versioni FortiPAM 1.1 tutte le versioni FortiPAM 1.2 tutte le versioni FortiPAM 1.3 tutte le versioni FortiPAM 1.4 versioni dalla 1.4.0 alla 1.4.2 FortiPAM 1.5.0 FortiProxy 1.0 tutte le versioni FortiProxy 1.1 tutte le versioni FortiProxy 1.2 tutte le versioni FortiProxy 2.0 tutte le versioni FortiProxy 7.0 tutte le versioni FortiProxy 7.2 tutte le versioni FortiProxy 7.4 tutte le versioni FortiProxy 7.6 versioni dalla 7.6.0 alla 7.6.3 FortiSwitchManager 7.0 versioni dalla 7.0.0 alla 7.0.3 FortiSwitchManager 7.2 versioni dalla 7.2.0 alla 7.2.5 FortiMail 7.0 tutte le versioni FortiMail 7.2 versioni dalla 7.2.0 alla 7.2.6 FortiMail 7.4 versioni dalla 7.4.0 alla 7.4.2 FortiManager 6.0 tutte le versioni FortiManager 6.2 tutte le versioni FortiManager 6.4 tutte le versioni FortiManager 7.0 versioni dalla 7.0.0 alla 7.0.13 FortiManager 7.2 versioni dalla 7.2.0 alla 7.2.9 FortiManager 7.4 versioni dalla 7.4.1 alla 7.4.5 FortiManager 7.6 versioni dalla 7.6.0 alla 7.6.1 FortiManager Cloud 7.4 versioni dalla 7.4.1 alla 7.4.3 FortiNDR 1.5 tutte le versioni FortiNDR 7.0 tutte le versioni FortiNDR 7.1 tutte le versioni FortiNDR 7.2 tutte le versioni FortiNDR 7.4 versioni dalla 7.4.0 alla 7.4.8 FortiNDR 7.6 versioni dalla 7.6.0 alla 7.6.1 FortiRecorder 7.0 versioni dalla 7.0.0 alla 7.0.4 FortiTester 4.2 tutte le versioni FortiTester 7.0 tutte le versioni FortiTester 7.1 tutte le versioni FortiTester 7.2 tutte le versioni FortiTester 7.3 tutte le versioni FortiTester 7.4 versioni dalla 7.4.0 alla 7.4.2 FortiVoice 6.0 versioni dalla 6.0.7 alla 6.0.12 FortiVoice 6.4 versioni dalla 6.4.0 alla 6.4.9 FortiVoice 7.0 versioni dalla 7.0.0 alla 7.0.4 FortiWeb 6.4 tutte le versioni FortiWeb 7.0 tutte le versioni FortiWeb 7.2 tutte le versioni FortiWeb 7.4 versioni dalla 7.4.0 alla 7.4.4 FortiWeb 7.6.0 FortiAnalyzer 6.4 tutte le versioni FortiAnalyzer 7.0 tutte le versioni FortiAnalyzer 7.2 tutte le versioni FortiAnalyzer 7.4 versioni dalla 7.4.0 alla 7.4.6 FortiAnalyzer 7.6 versioni dalla 7.6.0 alla 7.6.3 FortiAnalyzer Cloud 6.4 tutte le versioni FortiAnalyzer Cloud 7.0 versioni dalla 7.0.1 alla 7.0.13 FortiAnalyzer Cloud 7.2 versioni dalla 7.2.1 alla 7.2.8 FortiAnalyzer Cloud 7.4 versioni dalla 7.4.1 alla 7.4.5 FortiSRA 1.4 vesioni dalla 1.4.0 alla 1.4.2 FortiSRA Cloud 1.5.0 FortiClientMac 7.0 tutte le versioni FortiClientMac 7.2 versioni dalla 7.2.1 alla 7.2.11 FortiClientMac 7.4 versioni dalla 7.4.0 alla 7.4.3 FortiClientWindows 7.0 tutte le versioni FortiClientWindows 7.2 versioni dalla 7.2.1 alla 7.2.11 FortiClientWindows 7.4 versioni dalla 7.4.0 alla 7.4.3 :: Impatto Remote Code Execution Information Disclosure Security Restriction Bypass Elevation of Privilege Cross-Site Scripting Denial of Service :: Soluzioni Applicare gli aggiornamenti rilasciati dal produttore: https://fortiguard.fortinet.com/psirt/FG-IR-23-354 https://fortiguard.fortinet.com/psirt/FG-IR-24-041 https://fortiguard.fortinet.com/psirt/FG-IR-24-228 https://fortiguard.fortinet.com/psirt/FG-IR-24-361 https://fortiguard.fortinet.com/psirt/FG-IR-24-372 https://fortiguard.fortinet.com/psirt/FG-IR-24-442 https://fortiguard.fortinet.com/psirt/FG-IR-24-452 https://fortiguard.fortinet.com/psirt/FG-IR-24-457 https://fortiguard.fortinet.com/psirt/FG-IR-24-487 https://fortiguard.fortinet.com/psirt/FG-IR-24-542 https://fortiguard.fortinet.com/psirt/FG-IR-24-546 https://fortiguard.fortinet.com/psirt/FG-IR-25-037 https://fortiguard.fortinet.com/psirt/FG-IR-25-126 https://fortiguard.fortinet.com/psirt/FG-IR-25-653 https://fortiguard.fortinet.com/psirt/FG-IR-25-664 https://fortiguard.fortinet.com/psirt/FG-IR-25-684 https://fortiguard.fortinet.com/psirt/FG-IR-25-685 https://fortiguard.fortinet.com/psirt/FG-IR-25-756 https://fortiguard.fortinet.com/psirt/FG-IR-25-010 https://fortiguard.fortinet.com/psirt/FG-IR-25-378 https://fortiguard.fortinet.com/psirt/FG-IR-25-198 :: Riferimenti Fortinet https://www.fortiguard.com/psirt Mitre CVE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46718 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26008 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47569 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-50571 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22258 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25252 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25253 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25255 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31365 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31366 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31514 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46774 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47890 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54822 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57716 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57740 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-57741 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58325 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58903 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49201 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53845 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54973 GARR CERT Security Alert - subscribe/unsubscribe: http://www.cert.garr.it/alert/ricevi-gli-alert-di-cert -----BEGIN PGP SIGNATURE----- iGsEAREIACsWIQTGpdiR5MqstacBGHbBnEyTZRJgQgUCaO9ULA0cY2VydEBnYXJy Lml0AAoJEMGcTJNlEmBCSAAAniHbWb5+xZRq/H7p+DnNKRE5KtBQAJ90kAIQs4G0 8EjPlQ9yB9LL7eWeoA== =U1UO -----END PGP SIGNATURE-----