CVE-2024-26009: Weak authentication - FGFM protocol
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
Other sources
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in FortiOS, FortiProxy & FortiPAM may allow an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
— FortiGuard
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26009?
CVE-2024-26009 has been classified with a critical severity level due to the potential for unauthenticated access.
How do I fix CVE-2024-26009?
To mitigate CVE-2024-26009, upgrade FortiOS, FortiProxy, and FortiPAM to their respective patched versions as recommended by Fortinet.
What versions are affected by CVE-2024-26009?
CVE-2024-26009 affects FortiOS versions 6.4.0 through 6.4.15 and earlier than 6.2.16, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, and earlier than 7.0.15, and FortiPAM versions before 1.2.0.
Who can be impacted by CVE-2024-26009?
Any organization using the affected versions of FortiOS, FortiProxy, or FortiPAM can be impacted by CVE-2024-26009.
What type of vulnerability is CVE-2024-26009?
CVE-2024-26009 is classified as an authentication bypass vulnerability, which allows unauthorized access to the affected systems.