CVE-2024-26011

Published: Nov 12, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A missing authentication for critical function in Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14, FortiPAM version 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7, FortiSwitchManager version 7.2.0 through 7.2.3, 7.0.0 through 7.0.3, FortiPortal version 6.0.0 through 6.0.14, FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0.0 through 7.0.14, 6.4.0 through 6.4.15, 6.2.0 through 6.2.16, 6.0.0 through 6.0.18 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected (14)

Products: Fortinet: Fortios, Fortipam, Fortiproxy, Fortimanager, Fortiswitchmanager, Fortiportal

6 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	From 6.0.0 to 7.0.15
Fortinet Fortios	From 7.2.0 to 7.2.8
Fortinet Fortios	From 7.4.0 to 7.4.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortipam	From 1.0.0 to 1.3.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiproxy	From 1.0.0 to 7.0.17
Fortinet Fortiproxy	From 7.2.0 to 7.2.10
Fortinet Fortiproxy	From 7.4.0 to 7.4.4

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortimanager	From 6.4.0 to 6.4.15
Fortinet Fortimanager	From 7.0.0 to 7.0.12
Fortinet Fortimanager	From 7.2.0 to 7.2.5
Fortinet Fortimanager	From 7.4.0 to 7.4.3

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiswitchmanager	From 7.0.0 to 7.0.4
Fortinet Fortiswitchmanager	From 7.2.0 to 7.2.4

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiportal	From 5.3.0 to 6.0.15

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-032

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.