Affected Systems
Fortinet FortiSIEM version 7.5.0. FortiSIEM 7.6 is not affected. The vulnerability targets the gRPC service on TCP port 27918.
Exploitation Status
Public proof-of-concept exploit available. Released by Horizon3.ai. No evidence of active exploitation mentioned, but PoC enables unauthenticated remote code execution via path traversal and null-byte injection.
Business Impact
Unauthenticated attackers can achieve remote code execution on FortiSIEM 7.5.0 systems by exploiting the gRPC service on TCP 27918. The attack chain combines path traversal and null-byte injection to overwrite the Redis health check script (redishb.sh), which executes every 60 seconds via cron. This provides reliable code execution without authentication. Organizations running FortiSIEM 7.5.0 face immediate risk of full system compromise. Patch released (7.5.1+) last week.
Urgency
🔴 Immediate
Recommended Actions
- Upgrade FortiSIEM 7.5.0 to version 7.5.1 or above immediately per Fortinet advisory
- Block external access to TCP port 27918 (gRPC service) at network perimeter and restrict to trusted management networks only
- Audit FortiSIEM logs for suspicious connections to TCP 27918 from unexpected sources or unusual QueryResultReq gRPC calls
- Monitor /opt/charting/redishb.sh for unauthorized modifications and verify file integrity on FortiSIEM 7.5.0 systems
- If immediate patching is not possible, consider temporarily disabling the gRPC service on TCP 27918 until upgrade can be completed