Unauthenticated Device Configuration Disclosure in Fortinet FortiFone Web Portal

Successful exploitation allows unauthorized disclosure of the FortiFone device configuration to a remote unauthenticated attacker. Because configuration data can contain operationally sensitive settings and security-relevant information, exposure may facilitate follow-on compromise, including reconnaissance of the device environment, recovery of embedded secrets if present in configuration material, and abuse of trusted configuration knowledge to support further attacks. The supplied CVSS information indicates high impact to confidentiality, integrity, and availability, although the specifically documented primary effect is configuration disclosure.

If immediate patching is not possible, reduce exposure of the FortiFone Web Portal by restricting network access to trusted administrative sources only, minimizing or eliminating Internet exposure, and placing the management interface behind appropriate access controls such as VPN or internal segmentation. Monitor web access logs for anomalous crafted requests targeting the portal and review exposed devices for unauthorized configuration retrieval. These measures are temporary risk-reduction steps and do not replace upgrading to a fixed release.

Upgrade affected FortiFone deployments to fixed versions provided by Fortinet. FortiFone 3.0.13 through 3.0.23 should be upgraded to 3.0.24 or later, and FortiFone 7.0.0 through 7.0.1 should be upgraded to 7.0.2 or later. FortiFone 7.2 is reported as not affected.