Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-5587: FortiOS VM images can be tampered before installation
CVE-2019-5587 · published 7 years ago
Summary
FortiOS virtual machine images released before version 6.0.5 do not verify that the core operating files are unchanged. An attacker who can intercept the image could insert malicious software, potentially compromising the firewall when the image is deployed. Upgrade to FortiOS 6.0.5 or newer and ensure only trusted, signed images are used.
What to do
- Update fortinet fortios to version 6.0.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| fortinet | fortios |
< 6.0.5 cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
Original advisory text
Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassemb...
Lack of root file system integrity checking in Fortinet FortiOS VM application images all versions below 6.0.5 may allow attacker to implant malicious programs into the installing image by reassembling the image through specific methods.
References
- http://www.securityfocus.com/bid/108628 Broken Link
- https://fortiguard.com/advisory/FG-IR-19-017 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published4 Jun 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-5587 · NVD
Track software like this
Free during beta