CVE-2023-27997

CVE-2023-27997 FortiGate VM64 7.2.0 is exploitable by this code. note that the code was written in a very stupid way. Proof of Concept $ python3 exploit.py 192.168.106.142 10443 192.168.106.143 9999 + generating shellcode + salt=b'25c2dcf2' + processing hash + finding hash in cache - not in cache...

CVE-2021-44168

Exploit for CVE-2021-44168 Purpose Exploit CVE-2021-44168 to drop a shell on a Fortigate firewall and enable its access via LDPRELOAD tricks that execute when running some of Fortigate's CLI commands. You get a root shell. Use Compile: gcc -o gensrc-vispkgfile gensrc-vispkgfile.c -lz Run: %...

fortigate-belsen-leak

╔═════════════════════════════════════════════════════════════════════════════╗ ║ ███████╗ ██████╗ ██████╗ ████████╗██╗ ██████╗ █████╗ ████████╗███████╗ ║ ║ ██╔════╝██╔═══██╗██╔══██╗╚══██╔══╝██║██╔════╝ ██╔══██╗╚══██╔══╝██╔════╝ ║ ║ █████╗ ██║ ██║██████╔╝ ██║ ██║██║ ███╗███████║ ██║ █████╗ ║ ║...

CVE-2024-23113

CVE-2024-23113 The script is designed to detect CVE-2024-23113, which is a format string vulnerability in the FortiGate FGFM service FortiGate to FortiManager protocol running on TCP port 541. The vulnerability occurs because an attacker can control a format string, which could lead to Remote Cod...

at-doom-fortigate

At Doom Fortigate ================= =============== =============== ======== ======== \ . . . . . . .\ //. . . . . . .\ //. . . . . . .\ \. . .\// . . // ||. . .. . .|| ||. . .. . .|| ||. . .. . .|| || . . ./ . . .|| || . .|| ||. . || || . .|| ||. . || || . .|| ||. . || ||. . . . . . . ||...

CVE-2024-23113

CVE-2024-23113 The script is designed to detect CVE-2024-23113, which is a format string vulnerability in the FortiGate FGFM service FortiGate to FortiManager protocol running on TCP port 541. The vulnerability occurs because an attacker can control a format string, which could lead to Remote Cod...

CVE-2026-24858-FortiCloud-SSO-Authentication-Bypass

CVE-2026-24858 | FortiCloud SSO Authentication Bypass Executive Summary FortiCloud Single-Sign-On SSO a factory default enabled feature once you register any FortiGate/FortiManager/FortiAnalyzer contains a critical authentication-bypass flaw. An attacker who owns any FortiCloud account free or pa...

CVE-2019-6693

CVE-2019-6693 Decrypt FortiGate configuration secrets Original advisory Vendor advisory For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key. For versions above the non-default private-data-encryption parameter lets...

CVE-2018-13379

CVE-2018-13379 - FortiGate SSL-VPN Path Traversal PoC Description Proof-of-Concept script for CVE-2018-13379, a critical path traversal vulnerability in Fortinet FortiGate SSL VPN web portal. This vulnerability allows unauthenticated attackers to download system files via specially crafted HTTP...

forticrack_v8

Forticrack v8.0.0 Decrypt and extract FortiOS 8.0.0 firmware images. This script extends Bishop Fox's Forticrack to support 8.0.0 firmware images. Also, RandoriSec's article on FortiGate 7.4.7 firmware encryption was really helpful to reverse the encryption for FortiOS 8.0.0, since it looks like ...

fortiscan

Fortiscan CVE-2018-13379 FG-IR-18-384 Exploitation Tool, You can use this tool to check the vulnerability in your FortiGate SSL-VPN. This vulnerability affects the following versions: • FortiOS 6.0 - 6.0.0 to 6.0.4 • FortiOS 5.6 - 5.6.3 to 5.6.7 • FortiOS 5.4 - 5.4.6 to 5.4.12...

cve-2019-6693

FortiGate Password Decrypt Script - CVE-2019-6693 🔐 An authorized remote user with access or knowledge of the standard encryption key could gain access and decrypt the FortiOS backup files and all non-administrator passwords, private keys, and High Availability HA passwords. Overview This Python...

pocs_slides

Sharing my advisory, poc, slides and scripts to IoT / protocol security. You can find me at: Medium: https://medium.com/@cq674350529 Blog: https://cq674350529.github.io/ Mail: [email protected] Twitter: @cq674350529 Slides OffByOne2025: Patch Diffing, You Are My Sword! A Deep Dive into Two...

CVE-2024-23113

CVE-2024-23113 This python scripts searches a client list to see if their FortiGate device is vulnerable to this CVE. How To Use 1. Create a "clients.txt" file, and import a list of all your clients IP addresses. 2. Create a "vul.txt" file. This will be used to export the scripts findings. 3. Run...

CVE-2018-13379

CVE-2018-13379 CVE-2018-13379 https://blog.orange.tw/2019/08/attacking-ssl-vpn-part-2-breaking-the-fortigate-ssl-vpn.html https://fortiguard.com/psirt/FG-IR-18-384 The below versions of FortiOS were vulnerable. FortiOS 5.6.3 to 5.6.7 FortiOS 6.0.0 to 6.0.4 ONLY if the SSL VPN service web-mode or...

FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting

FortiGate FortiOS through SSL VPN Web Portal contains a cross-site scripting vulnerability. The login redir parameter is not sanitized, so an attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

CVE-2022-40684

CVE-2022-40684 CVE-2022-40684 - Auth bypass Run exploit USE: python3 exploit.py ⣀⡠⢤⡀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡴⠟⠃⠀⠀⠙⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠋⠀⠀⠀⠀⠀⠀⠘⣆⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢠⠾⢛⠒⠀⠀⠀⠀⠀⠀⠀⢸⡆⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣶⣄⡈⠓⢄⠠⡀⠀⠀⠀⣄⣷⠀⠀⠀⠀⠀⠀⠀...

CVE-2025-59718-Fortinet-Poc

CVEs: CVE-2025-59718 / CVE-2025-59719 Fortinet PoC Tool for detecting vulnerabilities associated with CVE-2025-59718 and CVE-2025-59719 on Fortinet devices FortiOS / FortiGate, using multiple identification techniques: passive, active, and authenticated. Supports: • Passive detection by...

CVE-2023-42791_CVE-2024-23666

Fortimanager insufficient authorization checks CVE-2024-23666 and unrestricted file upload CVE-2023-42791 exploitation scripts Two exploitation scripts leveraging these vulnerabilities are provided: rce.py: Provides a reverse shell or adds an arbitrary administrator from unprivileged access to th...