Plan ahead Critical Check your exposure CVSS 9.3
Fortinet FortiOS and FortiSASE routing flaw lets attackers send false routes
Fortinet PSIRTFortinet, FortiOS, FortiSASE
What happened. Fortinet reports an authentication bypass in the ospf daemon of FortiOS and FortiSASE, rated 9.3. An unauthenticated attacker may broadcast link-state advertisements (LSAs, routing messages) through a specially crafted request.
Who is affected. Users of Fortinet FortiOS and FortiSASE. Industrial sites using FortiGate firewalls at the IT and plant boundary may be exposed. The source gives no versions.
What to do. Check whether you run FortiOS or FortiSASE with OSPF (a routing protocol) enabled, and follow the Fortinet advisory for fixed versions.
When to act. Plan ahead: Firewall flaw rated 9.3 with no exploitation stated; check boundary firewalls before the next maintenance window.
Editor's reading
ForOT security leadIT security
- Purdue level
- L4
- L3.5
Why: FortiOS runs on firewalls that often separate office IT from plant networks, which places it in the industrial DMZ and enterprise levels. This is inferred from the product type.
- Are you exposed?
Check whether FortiOS devices have the OSPF daemon enabled and which interfaces accept OSPF traffic.
- If you cannot fix it yet
- Restrict OSPF to trusted interfaces and neighbours only.
- Disable OSPF on interfaces where it is not needed.
- Watch for
- Unexpected OSPF LSA messages from hosts that are not known routers.
- Unexpected changes to routing tables on boundary firewalls.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.