Visitor III

Question

Getting started with Fortinet firmware reverse engineering - resources and advice?

Forum|Forum|1 month ago
September 11, 2026
5 replies
223 views

Hi all,

Independent security researcher here (published CISA advisories, ICS/OT focus). I'm building out a local lab with various Fortinet VM images for firmware analysis and vulnerability research.

I've been able to pull FortiGate, FortiAnalyzer, FortiManager, FortiADC, FortiWeb, and FortiFirewall KVM images through the standard support portal with a basic FortiCare account. However, I'm hitting a wall on products that require an active support contract to download:

- FortiProxy (FPX_KVM)
- FortiMail (FML_VM64_KVM)
- FortiSandbox (FSA_KVM)
- FortiSIEM
- FortiNDR
- FortiDDoS-F

A few questions for the community:

1. Is there an evaluation or researcher program that provides access to VM images for these products? I've looked at FNDN but haven't dug deep enough yet.
2. For anyone doing RE on FortiProxy or FortiMail specifically - where did you start? Any recommended tooling, known filesystem structures, or resources (Fortinet Gurus, writeups, etc.)?
3. Has anyone used the FortiSandbox or FortiSIEM KVM images in a lab? I'm curious whether they boot cleanly in a standard KVM setup without a valid license (trial mode, etc.).
4. If anyone has older eval or trial images they'd be willing to share for research purposes, I'd appreciate it. I'm specifically interested in versions with known CVEs for reproduction/analysis.

Any pointers appreciated. Happy to share findings back.

osoleimani

Staff

Hi lmgod,

Thanks for the additional context.

Security research: For vulnerability research or security findings involving Fortinet products, the appropriate channel is the Fortinet PSIRT process:

Fortinet PSIRT

Hope this helps point you in the right direction.

llmgodAuthor

Visitor III

No problem, Im kinda just bouncing around trying to brainstorm to see if there are any legit routes. I'll make sure to report all findings to Fortinet. I'm working on a reverse engineering tool, and just need like monolithic firmware.

I always do proper disclosure 🫡

Just thought I'd come as close as I could to the source.

-nick

-llmgod

osoleimani

Staff

Hi Nick,

Thanks for clarifying, and welcome to the Fortinet Community!

I appreciate you taking the time to provide the additional context and your commitment to responsible disclosure.

For any security findings involving Fortinet products, please use the appropriate Fortinet PSIRT process.

Welcome aboard!

Regards,

llmgodAuthor

Visitor III

For reference I am a basic user. I have no license keys to Fortinet Firmware. I (did) have the most bare bones Fortinet.com access and abilities.

So that means anyone can do this, and reverse engineer the platforms that were originally in favor of a basic user and further enumerate the platform for exploits.

(as a basic user you are not given permissions to mess around with the platforms)

-llmgod

Matt_B

Staff & Editor

Thank you for your report llmgod. Note this is a public forum, so I will request [edit: your report] be removed by moderation team.

I’ll reach out to you over community site message feature.

For responsible disclosure, use the PSIRT contact form.
https://www.fortiguard.com/faq/psirt-contact
https://www.fortiguard.com/psirt_policy

Is it a bug, is it a feature? It's... not in spec!

Sign up

Login with SSO

Login to the community

Login with SSO