CVE-2024-26011

Published: Nov 12, 2024Modified: Oct 22, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiPortal 6.0.0 through 6.0.14, FortiPortal 5.3 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected (14)

Products: Fortinet: Fortios, Fortipam, Fortiproxy, Fortimanager, Fortiswitchmanager, Fortiportal

6 products

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	6.0.0 ≤ version < 7.0.15
Fortinet Fortios	7.2.0 ≤ version < 7.2.8
Fortinet Fortios	7.4.0 ≤ version < 7.4.4

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortipam	1.0.0 ≤ version < 1.3.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiproxy	1.0.0 ≤ version < 7.0.17
Fortinet Fortiproxy	7.2.0 ≤ version < 7.2.10
Fortinet Fortiproxy	7.4.0 ≤ version < 7.4.4

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortimanager	6.4.0 ≤ version < 6.4.15
Fortinet Fortimanager	7.0.0 ≤ version < 7.0.12
Fortinet Fortimanager	7.2.0 ≤ version < 7.2.5
Fortinet Fortimanager	7.4.0 ≤ version < 7.4.3

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiswitchmanager	7.0.0 ≤ version < 7.0.4
Fortinet Fortiswitchmanager	7.2.0 ≤ version < 7.2.4

Configuration F

1 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiportal	5.3.0 ≤ version < 6.0.15

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-032

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.