CVE-2023-29175: 
FortiOS vulnerability analysis and mitigation

An improper certificate validation vulnerability (CVE-2023-29175) was discovered in FortiOS and FortiProxy products. The vulnerability was internally discovered and reported by Wilfried Djettchou of Fortinet Product Security team and was initially published on June 12, 2023. The affected products include FortiOS versions 6.2 (all versions), 6.4 (all versions), 7.0.0 through 7.0.10, 7.2.0, and FortiProxy versions 1.2 (all versions), 2.0 (all versions), 7.0.0 through 7.0.9, and 7.2.0 through 7.2.3 (Fortinet Advisory).

The vulnerability is classified as CWE-295 (Improper Certificate Validation) with a CVSS v3.1 base score of 4.8 (Medium) and vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. The issue stems from improper certificate validation when establishing secure connections between the vulnerable device and the remote FortiGuard's map server (NVD).

The vulnerability could lead to information disclosure and potentially allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the vulnerable device and the remote FortiGuard's map server (Fortinet Advisory).

The vulnerability can be exploited by a remote and unauthenticated attacker. The attack complexity is considered high (AC:H), requires no privileges (PR:N), and no user interaction (UI:N) (NVD).

Fortinet has released patches to address this vulnerability. Users are advised to upgrade to FortiOS version 7.2.1 or above, FortiOS version 7.0.11 or above, FortiProxy version 7.2.4 or above, or FortiProxy version 7.0.10 or above (Fortinet Advisory).