CyberCVE

CVE-2024-21754

A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy ver

Severity
Low 1.7
CVSS 3.1
Exploited
Not listed
EPSS
0.035
88.6th percentile
Discovered by
Third party
Vendor advisory field
Published
Jun 11, 2024
Assigned by fortinet

Description

A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

Weakness: CWE-916

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Vendor-reported products (2)
  • Fortinet · FortiProxy
  • Fortinet · FortiOS

Credit

Fortinet is pleased to thank Hendrik Eckardt and Matthias Barkhausen from G DATA Advanced Analytics for reporting this vulnerability under responsible disclosure.

Vendor remediation

Please upgrade to FortiProxy version 7.4.3 or above Please upgrade to FortiOS version 7.4.4 or above

References

Something wrong here?