# MA-1009.012024: MyCERT Advisory - Fortinet Releases Security Updates for FortiOS and FortiProxy

**Date:** 14 Jan 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1009.012024  
**Advisory ID:** MA-1009.012024

---

**1.0 Introduction**
Recently, Fortinet has released a security update to address a vulnerability in FortiOS and FortiProxy software.
**2.0 Impact**
A cyber threat actor could exploit this vulnerability to take control of an affected system. An improper privilege management vulnerability [CWE-269] in a FortiOS & FortiProxy HA cluster may allow an authenticated attacker to perform elevated actions over the web administrative interface via crafted HTTP or HTTPS requests.
**3.0 Affected Products**
| Version | Affected | Solution | --- | --- | --- | FortiOS 7.4 | 7.4.0 through 7.4.1 | Upgrade to 7.4.2 or above | FortiOS 7.2 | 7.2.5 | Upgrade to 7.2.6 or above | FortiProxy 7.4 | 7.4.0 through 7.4.1 | Upgrade to 7.4.2 or above |
**4.0 Recommendations**
MyCERT encourages users and administrators to review the [FG-IR-23-315 FortiOS & FortiProxy - Improper authorization for HA requests](https://www.fortiguard.com/psirt/FG-IR-23-315) security bulletin and apply necessary updates.
Kindly refer to the following URL: <https://www.fortiguard.com/psirt/FG-IR-23-315>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.fortiguard.com/psirt/FG-IR-23-315>
- <https://www.cisa.gov/news-events/alerts/2024/01/09/fortinet-releases-security-updates-fortios-and-fortiproxy>