Stack-based Buffer Overflow in Fortinet's FortiOS and FortiProxy Service

CVE-2019-17656

Summary

A Stack-based Buffer Overflow vulnerability exists in the HTTPD daemon of Fortinet products including FortiOS and FortiProxy, specifically affecting versions 6.0.10 and below, 6.2.2 and below for FortiOS, and multiple versions of FortiProxy. This vulnerability allows an authenticated remote attacker to potentially crash the service by sending a specially crafted malformed PUT request. While Fortinet has not confirmed any successful exploitation leading to code execution, the threat remains significant for affected users and organizations relying on these services.

References