This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Fortinet fixes a large number of vulnerabilities
Fortinet fixes a large number of vulnerabilities in various products. The most severe ones are listed below. Individual products and their fixed versions: FortiSandbox - 5.0.1, 4.4.7, 4.2.8, 4.0.6 [1][2][10] FortiIsolator - 2.4.6 [3] FortiADC - 7.4.1, 7.2.2, 7.1.4 [4] FortiSIEM - 6.7.5, 6.6.4, 6.5.2, 6.4.3 [5] FortiOS - 7.6.1, 7.4.5, 7.2.10, 7.0.16, 6.4.16 [6][7][8] FortiProxy - 7.6.1, 7.4.7, 7.2.13, 7.0.20 [6][7] FortiNDR - 7.4.1, 7.2.2, 7.1.2, 7.0.6 [9] FortiPAM - 1.4.3, 1.3.2 [7] FortiSRA - 1.4.3 [7] FortiWeb - 7.6.1, 7.4.6, 7.2.11, 7.0.11[7]
An authenticated remote attacker with read permission can execute unauthorized commands in FortiSandbox via crafted requests [1].
The vulnerability is present in product:
- *:FortiSandbox; >=5.0.0, <5.0.1; >=4.4.0, <4.4.7; >=4.2.0, <4.2.8; >=4.0.0, <4.0.6; >=3.0.0, <4.0.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-52961 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An authenticated remote attacker with administrator-level read permission and CLI access can execute unauthorized code via specially crafted CLI commands [3].
The vulnerability is present in product:
- *:FortiIsolator; >=2.4.0, <2.4.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-55590 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An unauthenticated remote attacker can carry out an XSS attack in the FortiADC GUI using specially crafted HTTP or HTTPS requests [4].
The vulnerability is present in product:
- *:FortiADC; >=7.4.0, <7.4.1; >=7.2.0, <7.2.2; >=7.1.0, <7.1.4; =7.0; =6.2; =6.1; =6.0; =5.4; =5.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2023-37933 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An unauthenticated remote attacker can read the database password in FortiSIEM via crafted API requests [5].
The vulnerability is present in product:
- *:FortiSIEM; >=6.7.0, <6.7.5; >=6.6.0, <6.6.4; >=6.5.0, <6.5.2; >=6.4.0, <6.4.3; <=6.3
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2023-40723 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An authenticated local attacker can execute CLI commands with elevated privileges in FortiSandbox through the console menu in the GUI [2].
The vulnerability is present in product:
- *:FortiSandbox; >=4.4.0, <4.4.7
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45328 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An unauthenticated remote attacker can carry out an XSS attack in FortiOS and FortiProxy via a malicious Samba server [6].
The vulnerability is present in products:
- *:FortiOS; >=7.4.0, <7.4.4; >=7.2.0, <7.2.8; >=7.0.0, <7.0.14; >=6.4, <7.0.14
- *:FortiProxy; >=7.4.0, <7.4.4; >=7.2.0, <7.2.10; >=7.0.0, <7.0.17
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-26006 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 14. 3. 2025.
An unauthenticated remote attacker can perform unauthorized actions in FortiNDR via specially crafted HTTP GET requests [9].
The vulnerability is present in product:
- *:FortiNDR; =7.4.0, <7.4.1; >=7.2.0, <7.2.2; >=7.1.0, <7.1.2; >=7.0.0, <7.0.6; =1.5
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2023-48790 at cve.org, NVD
- CWE-352: Cross-Site Request Forgery (CSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An unauthenticated remote attacker can execute unauthorized code or commands in FortiOS, FortiProxy, FortiPAM, FortiSRA and FortiWeb via specially crafted HTTP or HTTPS commands [7].
The vulnerability is present in products:
- *:FortiOS; >=7.4.0, <7.4.5; >=7.2.0, <7.2.10; >=7.0.0, <7.0.16; >=6.4.0, <6.4.16; =6.2
- *:FortiPAM; >=1.4.0, <1.4.3; >=1.3.0, <1.3.2; =1.2; =1.1; =1.0
- *:FortiProxy; >=7.6.0, <7.6.1; >=7.4.0, <7.4.7; >=7.2.0, <7.2.13; >=7.0.0, <7.0.20;
- *:FortiSRA; >=1.4.0, <1.4.3
- *:FortiWeb; >=7.6.0, <7.6.1; >=7.4.0, <7.4.6; >=7.2.0, <7.2.11; >=7.0.0, <7.0.11
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-45324 at cve.org, NVD
- CWE-134: Use of Externally-Controlled Format String at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An authenticated remote attacker can execute unauthorized commands in FortiSandbox via specially crafted requests [10].
The vulnerability is present in product:
- *:FortiSandbox; >=4.4.0, <4.4.6; =4.2; =4.0; =3.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-54018 at cve.org, NVD
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 11. 3. 2025.
An authenticated remote attacker with write permission to the Security Fabric can escalate their privileges to super-admin level by connecting the target FortiGate to a malicious upstream FortiGate [8].
The vulnerability is present in product:
- *:FortiOS; >=7.6.0, <7.6.1; >=7.4.0, <7.4.5; >=7.2.0, <7.2.10; >=7.0.0, <7.0.16; =6.4
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-40591 at cve.org, NVD
- CWE-266: Incorrect Privilege Assignment at cwe.mitre.org
The vulnerability was publicly disclosed 13. 3. 2025.
Links
- [1] https://fortiguard.fortinet.com/psirt/FG-IR-24-306
- [2] https://fortiguard.fortinet.com/psirt/FG-IR-24-261
- [3] https://fortiguard.fortinet.com/psirt/FG-IR-24-178
- [4] https://www.fortiguard.com/psirt/FG-IR-23-216
- [5] https://www.fortiguard.com/psirt/FG-IR-23-117
- [6] https://www.fortiguard.com/psirt/FG-IR-23-485
- [7] https://fortiguard.fortinet.com/psirt/FG-IR-24-325
- [8] https://fortiguard.fortinet.com/psirt/FG-IR-24-302
- [9] https://fortiguard.fortinet.com/psirt/FG-IR-23-353
- [10] https://fortiguard.fortinet.com/psirt/FG-IR-24-110
By CESNET, z.s.p.o. Michaela Jarošová on 18. 3. 2025.