CVE-2024-33504: Use of Hard-coded Cryptographic Key to encrypt sensitive data
First published: Tue Feb 11 2025(Updated: )
A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0 all versions, 6.4 all versions may allow an attacker with JSON API access permissions to decrypt some secrets even if the 'private-data-encryption' setting is enabled.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiManager | >=7.6.0<=7.6.1>=7.4.0<=7.4.5>=7.2.0<=7.2.9=7.0=6.4 | |
| Fortinet FortiManager | >=7.6.0<=7.6.1 | |
| Fortinet FortiManager | >=7.4.0<=7.4.5 | |
| Fortinet FortiManager | >=7.2.0<=7.2.9 | |
| Fortinet FortiManager | >=7.0 | |
| Fortinet FortiManager | >=6.4 | |
| Fortinet FortiManager Cloud | >=7.4.1<=7.4.5 | |
| Fortinet FortiManager Cloud | >=7.2.1<=7.2.8 | |
| Fortinet FortiManager Cloud | >=7.0 | |
| Fortinet FortiManager Cloud | >=6.4 |
Remedy
Please upgrade to FortiManager version 7.6.2 or above Please upgrade to FortiManager version 7.4.6 or above Please upgrade to FortiManager version 7.2.10 or above Please upgrade to FortiManager Cloud version 7.6.2 or above Please upgrade to FortiManager Cloud version 7.4.6 or above Please upgrade to FortiManager Cloud version 7.2.9 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-33504?
CVE-2024-33504 has a high severity due to the potential for unauthorized decryption of sensitive data.
How do I fix CVE-2024-33504?
To fix CVE-2024-33504, upgrade FortiManager to the latest version that has addressed this vulnerability.
What versions of FortiManager are affected by CVE-2024-33504?
CVE-2024-33504 affects FortiManager versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, as well as all versions of 7.0 and 6.4.
What kind of access is required for an attacker to exploit CVE-2024-33504?
An attacker needs JSON API access permissions to exploit CVE-2024-33504 and decrypt sensitive information.
What type of vulnerability is CVE-2024-33504 classified as?
CVE-2024-33504 is classified as a use of hard-coded cryptographic key vulnerability under CWE-321.
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-33504
- agent/first-publish-date
- collector/fortiguard-psirt
- agent/title
- agent/references
- agent/softwarecombine
- agent/description
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/source
- agent/tags
- agent/event
- vendor/fortinet
- canonical/fortinet fortimanager
- version/fortinet fortimanager/7.6.0
- version/fortinet fortimanager/7.6.1
- version/fortinet fortimanager/7.4.0
- version/fortinet fortimanager/7.4.5
- version/fortinet fortimanager/7.2.0
- version/fortinet fortimanager/7.2.9
- version/fortinet fortimanager/7.0
- version/fortinet fortimanager/6.4
- canonical/fortinet fortimanager cloud
- version/fortinet fortimanager cloud/7.4.1
- version/fortinet fortimanager cloud/7.4.5
- version/fortinet fortimanager cloud/7.2.1
- version/fortinet fortimanager cloud/7.2.8
- version/fortinet fortimanager cloud/7.0
- version/fortinet fortimanager cloud/6.4