Skip to content
ConfigProof

All controls

FGT-SW-001MediumFortiGate

Software version is out of vendor support

At a glance

Base severity

Medium

Area

System and Metadata

Platform

FortiGate

Evidence level

Derived0.90

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

A release past the vendor's support no longer receives fixes, including security fixes, so a vulnerability found after that day stays open on this device until it is upgraded.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Plan an upgrade to a release the vendor still supports, following the vendor's upgrade path for the version in use.
  2. Until the upgrade, restrict management access to trusted addresses and review the vendor's advisories for this release.

Command line

FortiOS CLI

execute restore image tftp <image-file> <tftp-server>

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. FortiOS saves a change when you type next or end, with no separate commit. Read every line first.

Read it back

get system status
Values to fill in2
<image-file>
The firmware image file name for the release to upgrade to
<tftp-server>
The address of the server that holds the firmware image
Before you type it3
  • Written from the FortiOS CLI Reference, not yet run on a device. Read each line before typing it.
  • On a device with VDOMs, type these inside the VDOM (config vdom, edit the VDOM) or inside config global for a global setting.
  • Take a configuration backup first and plan a maintenance window: the device restarts during an upgrade. Choose the target release from the vendor's upgrade path for the version in use.

How to confirm the fix

  • Read the device version again after the upgrade and confirm the release is inside the vendor's published support.

Limits

  • The date is the vendor's published date for the release; it does not show a support contract or whether a fix exists for a given issue.
  • A release the table does not list is not judged.

Compliance references

No benchmark recommendation is mapped to this control in this version.

More in System and Metadata

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis