This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Fortinet fixes 11 vulnerabilities in various products

Fortinet fixes 11 vulnerabilities in various products. The most serious are listed below. Products and their fixed versions: FortiSwitch - 7.6.1, 7.4.5, 7.2.9, 7.0.11, 6.4.15 [1] FortiAnalyzer - 7.6.2, 7.4.6, 7.2.9, 7.0.14, 6.4.15, 6.2.14 [2][8] FortiManager - 7.6.2, 7.4.6, 7.2.9, 7.0.14, 6.4.15, 6.2.14 [2][8] FortiOS - 7.6.0 [2][5][10] FortiProxy - 7.4.3, 7.2.10, 7.0.16 [2] FortiVoice - 7.0.3, 6.4.9 [2] FortiWeb - 7.6.3, 7.4.7 [2][4][7] FortiIsolator - 2.4.7 [3][6] FortiClientEMS - 7.4.3 [9]

FortiSwitch - admin password change (CVE-2024-48887)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can modify admin passwords in FortiSwitch by sending specially crafted requests. As a temporary workaround, HTTP access to the administrative interface can be disabled; details can be found at [1].

The vulnerability is present in product:

  • FortiSwitch; ==7.6.0; >=7.4.0, <7.4.5; >=7.2.0, <7.2.9; >=7.0.0, <7.0.11; >=6.4.0, <6.4.15;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C

More information:

The vulnerability was publicly disclosed 8. 4. 2025.

FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice, FortiWeb - management device impersonation (CVE-2024-26013, CVE-2024-50565)
CVSS 7.5 (High)

An unauthenticated remote attacker in a MITM position can impersonate the management device (FortiCloud, FortiManager) in FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiVoice and FortiWeb.

The vulnerability is present in products:

  • *: FortiAnalyzer; >=7.4.0, <7.4.3; >=7.2.0, <7.2.5; >=7.0.0, <7.0.12; >=6.4.0, <6.4.15; >=6.2.0, <6.2.14;
  • *: FortiManager; >=7.4.0, <7.4.3; >=7.2.0, <7.2.5; >=7.0.0, <7.0.12; >=6.4.0, <6.4.15; >=6.2.0, <6.2.14;
  • *: FortiOS; >=7.4.0, <7.4.5; >=7.2.0, <7.2.9; >=7.0.0, <7.0.16; >=6.4, <6.5; >=6.2.0, <6.2.17;
  • *: FortiProxy; >=7.4.0, <7.4.3; >=7.2.0, <7.2.10; >=7.0.0, <7.0.16; >=2.0, <2.1;
  • *: FortiVoice; >=7.0.0, <7.0.3; >=6.4.0, <6.4.9; >=6.0, <6.1;
  • *: FortiWeb; >=7.4.0, <7.4.3; >=7.2, <7.3; >=7.0, <7.1;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

More information:

The vulnerability was publicly disclosed 8. 4. 2025.

FortiIsolator - OS command injection (CVE-2024-54024)
CVSS 7.2 (High)

An authenticated remote attacker with super-admin privileges and CLI access can make unauthorized execution of OS commands in FortiIsolator by sending specially crafted HTTP requests [3].

The vulnerability is present in product:

  • *: FortiIsolator; >=2.4.3, <2.4.7;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:C

More information:

  • CVE-2024-54024 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 4. 2025.

FortiClientEMS - XSS (CVE-2025-22855)
CVSS 2.7 (Low)

An authenticated remote attacker with administrator privileges can carry out an XSS attack [9].

The vulnerability is present in product:

  • *: FortiClientEMS; >=7.4.0, <7.4.2; >=7.2.1, <7.2.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

More information:

  • CVE-2025-22855 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 4. 2025.

By CESNET, z.s.p.o. Martin Krajči on 10. 4. 2025.

CESNET, z.s.p.o. Logo