Plan ahead Critical Check your exposure CVSS 9.6
Fortinet FortiOS and FortiSASE routing flaw could spread malformed data
Fortinet PSIRTFortinet, FortiOS, FortiSASE
What happened. Fortinet reports a numeric truncation flaw in the border gateway protocol (BGP) service of FortiOS and FortiSASE. A configured internal BGP neighbour could send malformed attributes to all connected routers through a crafted request. It is rated CVSS 9.6.
Who is affected. Users of FortiOS and FortiSASE with BGP configured. Industrial sites using Fortinet gateways for remote access are exposed, because vendors and engineers often reach plant systems through them.
What to do. Check whether you run FortiOS or FortiSASE with BGP neighbours configured, then apply the fix from the Fortinet advisory.
When to act. Plan ahead: Firewall and VPN gateway operators: review FortiOS exposure and fix before the next window.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L3.5
Why: FortiOS runs firewall and VPN gateways at the boundary between plant and corporate or internet networks, and the flaw affects the routing service on those gateways.
- Are you exposed?
Search your asset inventory for FortiOS and FortiSASE, and check whether the BGP daemon is enabled with internal BGP neighbours configured.
- If you cannot fix it yet
- Limit BGP sessions to known, trusted neighbours and filter the routing attributes they can send.
- Keep the gateway's management and routing interfaces off untrusted networks until patched.
- Restrict who can connect through the gateway and require multi-factor authentication.
- Watch for
- Unexpected BGP neighbour changes, session resets or malformed-attribute errors in FortiOS routing logs.
- Routing instability or router restarts across connected devices after BGP updates.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.