Paper/Archive/CVE-2024-26011

CVE-2024-26011

Fortinet FortiManager — A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2…

Description · from the CVE record

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiPortal 6.0.0 through 6.0.14, FortiPortal 5.3 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected

ProductAffectedFixed inSource
FortiManager7.4.0 – 7.4.2–CNA
FortiManager7.2.0 – 7.2.4–CNA
FortiManager7.0.0 – 7.0.11–CNA
FortiManager6.4.0 – 6.4.14–CNA
FortiOS7.4.0 – 7.4.3–CNA
FortiOS7.2.0 – 7.2.7–CNA
FortiOS7.0.0 – 7.0.14–CNA
FortiOS6.4.0 – 6.4.16–CNA
FortiOS6.2.0 – 6.2.17–CNA
FortiOS6.0.0 – 6.0.18–CNA
FortiSwitchManager7.2.0 – 7.2.3–CNA
FortiSwitchManager7.0.0 – 7.0.3–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)5.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reffortiguard.fortinet.com/psirt/FG-IR-24-032