CVE-2023-28002: 
FortiOS vulnerability analysis and mitigation

An improper validation of integrity check value vulnerability (CWE-354) was discovered in FortiOS virtual machines. The vulnerability affects multiple versions of FortiOS: versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, and all versions of 6.4, 6.2, and 6.0. This vulnerability was initially published on November 14, 2023, and was discovered by Michael Anastasakis, Grégoire Lodi, and Rustam Komildzhonov from Klarna under responsible disclosure (Fortiguard PSIRT).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 5.8. The vulnerability stems from improper validation of integrity check values in FortiOS VMs, which affects the system's boot process security mechanisms. The CVSS vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, indicating that the vulnerability requires local access and high privileges for exploitation (NVD).

The vulnerability allows a local attacker with administrative privileges to boot a malicious image on the device and bypass the filesystem integrity check in place. This could potentially lead to the execution of unauthorized code or commands on the affected system (Fortiguard PSIRT).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to the following versions: FortiOS 7.2.4 or above for 7.2.x versions, FortiOS 7.0.13 or above for 7.0.x versions. For FortiOS versions 6.4, 6.2, and 6.0, users should migrate to a fixed release. Fortinet provides an upgrade tool to help users follow the recommended upgrade path (Fortiguard PSIRT).