This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 31 vulnerabilities in various products

Fortinet fixes 31 vulnerabilities in various products. The most severe vulnerabilities are listed below. Individual products and their fixed versions: FortiWeb - 7.4.2, 7.2.8 [1] FortiRecorder - 7.2.2, 7.0.5 [2] FortiManager - 7.4.4 [3][10] FortiManager Cloud - 7.4.4 [3][10] FortiClientEMS - 7.2.5, 7.0.11 [4] FortiPortal - 7.2.5, 7.0.9 [5] FortiAP - 7.4.3, 7.2.4 [6] FortiAP-S - 6.4.10 [6] FortiAP-W2 - 7.4.3, 7.2.4 [6] FortiVoice - 7.0.2, 6.4.9 [7] FortiSwitch - 7.4.1, 7.2.6, 7.0.8, 6.4.14, 6.2.8 [8] FortiSandbox - 4.4.5, 4.2.7, 4.0.5 [9] FortiAnalyzer - 7.6.2, 7.4.4 FortiAnalyzer Cloud - 7.4.4 FortiOS - 7.0.17 [10][11] FortiProxy - 7.2.13, 7.0.20 [10][11]

Fortinet FortiWeb - RCE (CVE-2024-21758)
CVSS 6.4 (Medium)

Allows a local authenticated attacker to execute code in FortiWeb using specially crafted CLI commands [1].

The vulnerability is present in product:

  • *:FortiWeb; >=7.4.0, <=7.4.1; >=7.2.0, <=7.2.7

CVSS: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiRecorder - file deletion (CVE-2024-47566)
CVSS 5.1 (Medium)

Allows a local authenticated attacker to delete files from the operating system in FortiRecorder using specially crafted CLI requests [2].

The vulnerability is present in product:

  • *:FortiRecorder; >=7.2.0, <=7.2.1; >=7.0.0, <=7.0.4; >=6.4, <7;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H/E:P/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiManager - configuration leak (CVE-2024-35277)
CVSS 8.6 (High)

Allows an unauthenticated remote attacker to view the configuration of all managed devices in FortiManager (Cloud) [3].

The vulnerability is present in products:

  • *:FortiManager Cloud; >=7.4.1, <=7.4.2; >=7.2.1, <=7.2.5; >=7.0.1, <=7.0.12;
  • *:FortiManager; >=7.4.0, <=7.4.2; >=7.2.0, <=7.2.5; >=7.0.0, <=7.0.12; >=6.4.0, <=6.4.14

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:F/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiClientEMS - bruteforce attack (CVE-2024-23106)
CVSS 8.1 (High)

Allows an unauthenticated remote attacker to perform a brute-force attack in FortiClientEMS due to insufficient protection mechanisms [4].

The vulnerability is present in product:

  • *:FortiClientEMS; >=7.2.0, <=7.2.3; >=7.0.0, <=7.0.10; >=6.4, <6.5; >=6.2, <6.3;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiPortal - database schema leak (CVE-2024-35278)
CVSS 4.3 (Medium)

Allows an authenticated remote attacker to obtain internal information about the database in FortiPortal, such as its schema [5].

The vulnerability is present in product:

  • *:FortiPortal; >=7.2.0, <=7.2.4; >=7.0.0, <=7.0.8

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiSIEM - connection DoS (CVE-2024-46667)
CVSS 7.5 (High)

Allows an unauthenticated remote attacker to cause a DoS attack on incoming TLS connections in FortiSIEM [12].

The vulnerability is present in product:

  • *:FortiSIEM; >=7.1.0, <=7.1.5; >=7.0, <7.1; >=6.7, <6.8; >=6.6, <6.7; >=6.5, <6.6; >=6.4, <6.5; >=6.3, <6.4; >=6.2, <6.3; >=6.1, <6.2; >=5.4, <5.5; >=5.3, <5.4;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:W/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiAP(-S), FortiAP-W2 - RCE (CVE-2024-26012)
CVSS 6.7 (Medium)

Allows a local authenticated attacker to execute code in FortiAP(-S) and FortiAP-W2 via the command line [6].

The vulnerability is present in products:

  • *:FortiAP; >=7.4.0, <=7.4.2; >=7.2.0, <=7.2.3; >=7.0, <7.1; >=6.4, <6.5;
  • *:FortiAP-S; >=6.4.0, <=6.4.9; >=6.2, <6.3;
  • *:FortiAP-W2; >=7.4.0, <=7.4.2; >=7.2.0, <=7.2.3; >=7.0, <7.1; >=6.4, <6.5;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiVoice Entreprise - SQL injection (CVE-2023-37931)
CVSS 8.8 (High)

Allows a remote authenticated attacker to perform an SQL injection attack in FortiVoice Entreprise by sending specially crafted HTTP requests [7].

The vulnerability is present in product:

  • *:FortiVoice; >=7.0.0, <=7.0.1; >=6.4.0, <=6.4.8; >=6.0, <6.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

More information:

  • CVE-2023-37931 at cve.org, NVD
  • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiSwitch - RCE (CVE-2023-37936)
CVSS 9.8 (Critical)

Allows an unauthenticated remote attacker to execute code or commands in FortiSwitch due to a hard-coded cryptographic key. Exploiting the vulnerability requires the attacker to know this key [8].

The vulnerability is present in product:

  • *:FortiSwitch; ==7.4.0; >=7.2.0, <=7.2.5; >=7.0.0, <=7.0.7; >=6.4.0, <=6.4.13; >=6.2.0, <=6.2.7; >=6.0.0, <=6.0.7

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiSandbox - command execution (CVE-2024-27778)
CVSS 8.8 (High)

Allows a remote authenticated attacker with read privileges to execute operating system commands in FortiSandbox by sending specially crafted requests [9].

The vulnerability is present in product:

  • *:FortiSandbox; >=4.4.0, <=4.4.4; >=4.2.0, <=4.2.6; >=4.0.0, <=4.0.4; >=3.2, <3.3; >=3.1, <3.2; >=3.0.5, <=3.0.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X

More information:

  • CVE-2024-27778 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiOS, FortiProxy - authentication bypass (CVE-2024-55591)
CVSS 9.8 (Critical)

Allows an unauthenticated remote attacker to obtain super-admin privileges in FortiOS and FortiProxy by sending specially crafted websocket requests. IoCs for the vulnerability can be found at [11]. As a temporary workaround, the web administration interface can be disabled or access to it restricted to trusted IP addresses only. Details of the temporary workaround can be found at [11]. A PoC has been published for the vulnerability [13].

The vulnerability is present in products:

  • *:FortiOS; >=7.0.0, <=7.0.16;
  • *:FortiProxy; >=7.2.0, <=7.2.12; >=7.0.0, <=7.0.19;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

Fortinet FortiAnalyzer, FortiManager, FortiOS, FortiProxy - (CVE-2024-48886, CVE-2024-50563)
CVSS 9.0 (Critical)

Allows an unauthenticated remote attacker with access to the Security Fabric interface to take control of devices protected by Security Fabric in FortiAnalyzer, FortiManager, FortiOS and FortiProxy. As a temporary workaround, Security Fabric can be disabled or a very strong "group-password" (at least 20 random characters) can be chosen [10].

The vulnerability is present in products:

  • *:FortiAnalyzer Cloud; >=7.4.1, <=7.4.3;
  • *:FortiAnalyzer; >=7.6.0, <=7.6.1; >=7.4.1, <=7.4.3;
  • *:FortiManager; >=7.6.0, <=7.6.1; >=7.4.1, <=7.4.3;
  • *:FortiManager Cloud; >=7.4.1, <=7.4.3;
  • *:FortiOS; >=7.4.0, <=7.4.4; >=7.2.0, <=7.2.8; >=7.0.0, <=7.0.15; >=6.4, <6.5;
  • *:FortiProxy; >=7.4.0, <=7.4.4; >=7.2.0, <=7.2.10; >=7.0.0, <=7.0.17; >=2.0.0, <=2.0.14;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R

More information:

The vulnerability was publicly disclosed 14. 1. 2025.

By CESNET, z.s.p.o. Martin Krajči on 23. 1. 2025.

CESNET, z.s.p.o. Logo