← Back

CVE-2024-26009

nvd nist
Published: Aug 12, 2025Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.2 / Impact: 5.9
Source: NVD

Description

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

Affected (8)

Fortinet
4 products
Fortiswitchmanager
Fortiproxy
Fortipam
Fortios
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiswitchmanager
From 7.0.0 to 7.0.4
Fortiswitchmanager
From 7.2.0 to 7.2.4
Configuration B
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
From 7.0.0 to 7.0.16
Fortiproxy
From 7.2.0 to 7.2.9
Fortiproxy
From 7.4.0 to 7.4.3
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Fortipam
From 1.0.0 to 1.2.0
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.0.0 to 6.2.17
Fortios
From 6.4.0 to 6.4.16

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.