by Kastro
Paper/Archive/CVE-2024-35276

CVE-2024-35276

Fortinet FortiAnalyzer — A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyz…

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.5.375 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.4.1 through 7.4.3, FortiAnalyzer Cloud 7.2.1 through 7.2.5, FortiAnalyzer Cloud 7.0.1 through 7.0.11, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0.1 through 7.0.11, FortiManager Cloud 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected

ProductAffectedFixed inSource
FortiAnalyzer7.4.0 – 7.4.3–CNA
FortiAnalyzer7.2.0 – 7.2.5–CNA
FortiAnalyzer7.0.0 – 7.0.12–CNA
FortiAnalyzer6.4.0 – 6.4.14–CNA
FortiManager Cloud7.4.1 – 7.4.3–CNA
FortiManager Cloud7.2.1 – 7.2.5–CNA
FortiManager Cloud7.0.1 – 7.0.11–CNA
FortiManager Cloud6.4.1 – 6.4.7–CNA
FortiAnalyzer Cloud7.4.1 – 7.4.3–CNA
FortiAnalyzer Cloud7.2.1 – 7.2.5–CNA
FortiAnalyzer Cloud7.0.1 – 7.0.11–CNA
FortiAnalyzer Cloud6.4.1 – 6.4.7–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)5.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

reffortiguard.fortinet.com/psirt/FG-IR-24-165