Debug commands allow memory manipulation

Summary

A debug functionality in FortiGate may allow a privileged user to execute unauthorized code or commands via specific

chains of print str and cmd mem cli commands to, respectively, read and write hexadecimal values to any memory address.

Affected Products

FortiGate version 7.0.0.
FortiGate version 6.4.6 and below .
FortiGate version 6.2.9 and below.
FortiGate 6.0 all versions.
FortiGate 5.6 al versions.

Solutions

Please upgrade to FortiGate version 7.0.1 or above.
Please upgrade to FortiGate version 6.4.7 or above.
Please upgrade to FortiGate version 6.2.10 or above.

Acknowledgement

Fortinet is pleased to thank Orange CERT-CC team for reporting this vulnerability under responsible disclosure.