Fortinet FortiFone devices are susceptible to an unauthenticated information disclosure vulnerability that exposes sensitive configuration data.

This vulnerability involves the exposure of sensitive configuration information to unauthorized actors, permitting an unauthenticated attacker to extract data by sending specially crafted web requests.

With a CVSS score of 9.8, this vulnerability poses a severe risk to organizational confidentiality. Exposure of device configurations may reveal credentials, network topology, or other sensitive infrastructure details that enable further targeted attacks against the internal environment.

Immediate Action: Apply the latest firmware update provided by Fortinet for all affected FortiFone units.

Proactive Monitoring: Review web access logs for suspicious HTTP/HTTPS requests that appear to be attempting to access configuration files or sensitive endpoints.

Compensating Controls: Restrict management access to the FortiFone interface to trusted management subnets only and employ firewall rules to block unauthorized external access.

Public Exploit Available: Unknown

Configuration disclosure represents a significant security oversight that facilitates further exploitation. Administrators must ensure that patches are applied promptly and that management interfaces are properly hardened against unauthorized access.