Report feedback

An unauthenticated remote attacker can bypass authentication in FortiOS and FortiProxy by sending specially crafted requests and thereby obtain super-administrator privileges. As a temporary fix, it is possible to disable the web administration interface or restrict access to trusted IP addresses only. Details of the temporary fix and a list of IoCs can be found at [1].

The vulnerability is present in products:

• *:FortiOS; >=7.0.0, <=7.0.16;
• *:FortiProxy; >=7.2.0, <=7.2.12; >=7.0.0, <=7.0.19;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C

More information:

• CVE-2024-55591 at cve.org, NVD
• CVE-2025-24472 at cve.org, NVD
• CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An unauthenticated remote attacker can access source code in FortiPortal using specially crafted HTTP requests [2].

The vulnerability is present in product:

• *:FortiPortal; >=7.4.0, <=7.4.2; >=7.2.0, <=7.2.6; >=7.0.0, <=7.0.11;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:X/RC:C

More information:

• CVE-2025-24470 at cve.org, NVD
• CWE-41: Information disclosure at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An authenticated remote attacker with administrator privileges can execute commands in the operating system of FortiWeb via the API [3].

The vulnerability is present in product:

• *:FortiWeb; ==7.6.0; >=7.4.0, <=7.4.5; >=7.2, <7.3; >=7.0, <7.1;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

• CVE-2024-50567 at cve.org, NVD
• CVE-2024-50569 at cve.org, NVD
• CWE-78: Execute unauthorized code or commands at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An authenticated remote attacker can carry out an XSS attack in FortiSandbox [4]

The vulnerability is present in product:

• FortiSandbox; >=4.4.0, <=4.4.4; >=4.2.0, <=4.2.6; >=4.0.0, <=4.0.4; >=3.2, <3.3; >=3.1, <3.2; >=3.0, <3.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X

More information:

• CVE-2024-27781 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An authenticated remote attacker can execute commands in the operating system of FortiAnalyzer and FortiManager by sending specially crafted HTTP requests [5].

The vulnerability is present in products:

• *: FortiAnalyzer; >=7.4.0, <7.4.4; >=7.2.0, <7.2.6; >=7.0, <7.1; >=6.4, <6.5; >=6.2.2, <6.3;
• *: FortiAnalyzer Cloud; >=7.4.1, <7.4.4; >=7.2.1, <7.2.6; >=7.0, <7.1; >=6.4, <6.5;
• *: FortiAnalyzer-BigData; ==7.4.0; >=7.2.0, <7.2.8; >=7.0, <7.1; >=6.4, <6.5; >=6.2, <6.3;
• *: FortiManager; >=7.4.0, <7.4.4; >=7.2.0, <7.2.6; >=7.0, <7.1; >=6.4, <6.5; >=6.2.2, <6.3;
• *: FortiManager Cloud; >=7.4.1, <7.4.4; >=7.2.1, <7.2.6; >=7.0, <7.1; >=6.4, <6.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

• CVE-2024-40584 at cve.org, NVD
• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An authenticated remote attacker can carry out an XSS attack in FortiSIEM [6].

The vulnerability is present in product:

• *: FortiSIEM; >=7.1, <7.2; >=7.0, <7.1; >=6.7, <6.8;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:X

More information:

• CVE-2024-27780 at cve.org, NVD
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.

An authenticated local attacker can execute commands without authorization in FortiOS, FortiSwitchManager, FortiProxy and FortiPAM by sending specially crafted command-line requests [7].

The vulnerability is present in products:

• *: FortiOS; >=7.4, <7.5; >=7.2.0, <7.2.7; >=7.0.0, <7.0.14; >=6.4, <6.5; >=6.2, <6.3;
• *: FortiSwitchManager; >=7.2.0, <7.2.3; >=7.0.0, <7.0.3;
• *: FortiProxy; >=7.4.0, <7.5; >=7.2.0, <7.2.7; >=7.0.0, <7.0.15; >=2.0, <2.1; >=1.2, <1.3;
• *: FortiPAM; >=1.1.0, <1.1.3; >=1.0, <1.1;

CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

• CVE-2023-40721 at cve.org, NVD
• CWE-134: Use of Externally-Controlled Format String at cwe.mitre.org

The vulnerability was publicly disclosed 11. 2. 2025.