CyberCVE

CVE-2024-26011

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 throu

Severity
Medium 5.2
CVSS 3.1
Remote · no auth what this means
Exploited
Not listed
EPSS
0.006
49.1th percentile
Discovered by
Vendor
Vendor advisory field
Published
Nov 12, 2024
Assigned by fortinet

Description

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiPortal 6.0.0 through 6.0.14, FortiPortal 5.3 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Weakness: CWE-306

Affected products

Vendor Product Category Matched by
Fortinet FortiManager Check your version Network & Security Management cna-assigner
Fortinet FortiOS Check your version Firewall / NGFW cna-assigner
Fortinet FortiPAM Identity / IAM / MFA cna-assigner
Fortinet FortiPortal Network & Security Management cna-assigner
Fortinet FortiProxy Check your version SASE / SSE / Secure Web cna-assigner
Fortinet FortiSwitch Routing & Switching cna-assigner
Vendor-reported products (6)
  • Fortinet · FortiManager
  • Fortinet · FortiOS
  • Fortinet · FortiSwitchManager
  • Fortinet · FortiPAM
  • Fortinet · FortiPortal
  • Fortinet · FortiProxy

Credit

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.

Vendor remediation

Upgrade to upcoming FortiAuthenticator version 7.0.0 or above Upgrade to FortiWeb version 7.6.0 or above Upgrade to FortiWeb version 7.4.3 or above Upgrade to FortiVoice version 7.0.2 or above Upgrade to FortiVoice version 6.4.9 or above Upgrade to FortiSwitchManager version 7.2.4 or above Upgrade to FortiSwitchManager version 7.0.4 or above Upgrade to FortiProxy version 7.4.4 or above Upgrade to FortiProxy version 7.2.10 or above Upgrade to FortiProxy version 7.0.17 or above Upgrade to FortiPortal version 6.0.15 or above Upgrade to FortiPAM version 1.3.0 or above Upgrade to FortiOS version 7.6.0 or above Upgrade to FortiOS version 7.4.4 or above Upgrade to FortiOS version 7.2.8 or above Upgrade to FortiOS version 7.0.15 or above Upgrade to FortiManager version 7.4.3 or above Upgrade to FortiManager version 7.2.5 or above Upgrade to FortiManager version 7.0.12 or above Upgrade to FortiManager version 6.4.15 or above

References

Something wrong here?