← Back

CVE-2024-26013

nvd nist
Published: Apr 8, 2025Modified: Jul 25, 2025

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2 before 6.4.8 and Fortinet FortiWeb before 7.4.2 may allow an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device

Affected (19)

Fortinet
6 products
Fortianalyzer
Fortimanager
Fortios
Fortiproxy
Fortivoice
Fortiweb
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortianalyzer
From 6.2.0 to 6.2.14
Fortianalyzer
From 6.4.0 to 6.4.15
Fortianalyzer
From 7.0.0 to 7.0.12
Fortianalyzer
From 7.2.0 to 7.2.5
Fortianalyzer
From 7.4.0 to 7.4.3
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortimanager
From 6.2.0 to 6.2.14
Fortimanager
From 6.4.0 to 6.4.15
Fortimanager
From 7.0.0 to 7.0.12
Fortimanager
From 7.2.0 to 7.2.5
Fortimanager
From 7.4.0 to 7.4.3
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.4.0 to 7.0.16
Fortios
From 7.2.0 to 7.2.9
Fortios
From 7.4.0 to 7.4.5
Configuration D
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
From 2.0.0 to 7.0.16
Fortiproxy
From 7.2.0 to 7.2.10
Fortiproxy
From 7.4.0 to 7.4.3
Configuration E
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortivoice
From 6.0.0 to 6.4.9
Fortivoice
From 7.0.0 to 7.0.3
Configuration F
1 vulnerable
Vulnerable SoftwareAffected Versions
Fortiweb
From 7.4.0 to 7.4.3

Related CWEs

CWE-923
Improper Restriction of Communication Channel to Intended Endpoints
The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.