Supers override fails to properly override supervisor address

An attacker with network access to the FortiSIEM Windows Agent installation process could bypass the intended supervisor address override, potentially redirecting the agent to report to an attacker-controlled server instead of the legitimate SIEM. This could allow the attacker to intercept security logs and blind monitoring of the affected Windows systems.

Windows systems running FortiSIEM Agent for log aggregation and security monitoring. This affects organizations using Fortinet's SIEM solution for centralized event collection, particularly those monitoring OT or critical infrastructure networks where log integrity and chain-of-custody are essential.

An attacker on the local network intercepts or manipulates the FortiSIEM Windows Agent installer during deployment or updates. By crafting a malicious override for the supervisor address, the attacker redirects the agent to a compromised SIEM server. The agent then sends all security events and logs to the attacker's server instead of the legitimate monitoring infrastructure, allowing the attacker to suppress alerts and cover their tracks.