CVE-2024-35277: Missing authentication for managed device configuration files
First published: Tue Jan 14 2025(Updated: )
A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiManager Cloud | >=7.4.1<=7.4.2 | |
| Fortinet FortiManager Cloud | >=7.2.1<=7.2.5 | |
| Fortinet FortiManager Cloud | >=7.0.1<=7.0.12 | |
| Fortinet FortiManager | >=7.4.0<=7.4.2 | |
| Fortinet FortiManager | >=7.2.0<=7.2.5 | |
| Fortinet FortiManager | >=7.0.0<=7.0.12 | |
| Fortinet FortiManager | >=6.4.0<=6.4.14 | |
| Fortinet FortiManager | >=6.4.0<6.4.15 | |
| Fortinet FortiManager | >=7.0.0<7.0.13 | |
| Fortinet FortiManager | >=7.2.0<7.2.6 | |
| Fortinet FortiManager | >=7.4.0<7.4.3 | |
| Fortinet FortiManager Cloud | >=7.0.1<7.0.13 | |
| Fortinet FortiManager Cloud | >=7.2.1<7.2.7 | |
| Fortinet FortiManager Cloud | >=7.4.1<7.4.3 |
Remedy
Please upgrade to FortiManager version 7.4.3 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiManager version 7.0.13 or above Please upgrade to FortiManager version 6.4.15 or above Please upgrade to FortiManager Cloud version 7.4.3 or above Please upgrade to FortiManager Cloud version 7.2.7 or above Please upgrade to FortiManager Cloud version 7.0.13 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-35277?
CVE-2024-35277 has a high severity due to missing authentication for critical functions, allowing unauthorized access to device configurations.
How do I fix CVE-2024-35277?
To fix CVE-2024-35277, upgrade to FortiManager version 7.4.3 or later, 7.2.7 or later, 7.0.13 or later, or ensure FortiPortal is updated to versions above 6.0.15.
Which versions are affected by CVE-2024-35277?
CVE-2024-35277 affects Fortinet FortiPortal versions 6.0.0 to 6.0.15 and FortiManager versions 7.4.0 to 7.4.2, 7.2.0 to 7.2.5, 7.0.0 to 7.0.12, and 6.4.0 to 6.4.14.
What are the implications of CVE-2024-35277 on security?
The implications of CVE-2024-35277 on security include the potential for attackers to access and manipulate device configurations leading to further breaches.
Is there a mitigation for CVE-2024-35277?
While upgrading is the main remedy, ensuring proper access controls and monitoring can help mitigate the risks posed by CVE-2024-35277.
- agent/weakness
- agent/remedy
- agent/type
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-35277
- agent/first-publish-date
- agent/title
- agent/references
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/fortiguard-psirt
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/fortinet
- canonical/fortinet fortimanager cloud
- version/fortinet fortimanager cloud/7.4.1
- version/fortinet fortimanager cloud/7.4.2
- version/fortinet fortimanager cloud/7.2.1
- version/fortinet fortimanager cloud/7.2.5
- version/fortinet fortimanager cloud/7.0.1
- version/fortinet fortimanager cloud/7.0.12
- canonical/fortinet fortimanager
- version/fortinet fortimanager/7.4.0
- version/fortinet fortimanager/7.4.2
- version/fortinet fortimanager/7.2.0
- version/fortinet fortimanager/7.2.5
- version/fortinet fortimanager/7.0.0
- version/fortinet fortimanager/7.0.12
- version/fortinet fortimanager/6.4.0
- version/fortinet fortimanager/6.4.14