CVE-2024-40593

Published: Dec 11, 2025Modified: Jun 17, 2026

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.

Affected (9)

Products: Fortinet: Fortianalyzer, Fortimanager, Fortios, Fortiportal

4 products

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.4.0 to 7.2.6
Fortinet Fortianalyzer	From 7.4.0 to 7.4.3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortimanager	From 6.4.0 to 7.2.6
Fortinet Fortimanager	From 7.4.0 to 7.4.3

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	Version 7.0.14
Fortinet Fortios	Version 7.2.7
Fortinet Fortios	Version 7.4.4
Fortinet Fortios	Version 7.6.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiportal	From 6.0.0 to 6.0.15

Related CWEs

References (1)

https://fortiguard.fortinet.com/psirt/FG-IR-24-133

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.