CVE-2024-21757: Priviledged admin able to modify super-admins password
A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.
Other sources
An unverified password change vulnerability [CWE-620] in FortiManager or FortiAnalyzer may allow a read-write user to modify admin passwords via the device configuration backup.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-21757?
CVE-2024-21757 has been assigned a critical severity rating due to the potential for unauthorized password change.
How do I fix CVE-2024-21757?
To fix CVE-2024-21757, update Fortinet FortiManager and FortiAnalyzer to versions 7.0.11, 7.2.5, or 7.4.2 or later.
What versions are affected by CVE-2024-21757?
CVE-2024-21757 affects FortiManager versions 7.0.0 to 7.0.10, 7.2.0 to 7.2.4, and 7.4.0 to 7.4.1, as well as FortiAnalyzer in the same version ranges.
Can CVE-2024-21757 be exploited remotely?
Yes, CVE-2024-21757 can be exploited remotely, allowing attackers the ability to change passwords without verification.
What products are affected by CVE-2024-21757?
CVE-2024-21757 affects Fortinet products including FortiManager and FortiAnalyzer within specific versions.