by Kastro
Paper/Archive/CVE-2024-48886

CVE-2024-48886

Fortinet FortiOS — A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15,…

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.1.411 × 208.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.

Affected

ProductAffectedFixed inSource
FortiOS7.4.0 – 7.4.4–CNA
FortiOS7.2.0 – 7.2.8–CNA
FortiOS7.0.0 – 7.0.15–CNA
FortiOS6.4.0 – 6.4.15–CNA
FortiProxy7.4.0 – 7.4.4–CNA
FortiProxy7.2.0 – 7.2.10–CNA
FortiProxy7.0.0 – 7.0.17–CNA
FortiProxy2.0.0 – 2.0.14–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
fortinet (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reffortiguard.fortinet.com/psirt/FG-IR-24-221