CVE-2024-36505: Real-time file system integrity checking write protection bypass
First published: Tue Aug 13 2024(Updated: )
An improper access control vulnerability [CWE-284] in FortiOS 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14 and 6.4.x may allow an attacker who has already successfully obtained write access to the underlying system (via another hypothetical exploit) to bypass the file integrity checking system.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS IPS Engine | >=7.4.0<=7.4.3 | |
| Fortinet FortiOS IPS Engine | >=7.2.5<=7.2.7 | |
| Fortinet FortiOS IPS Engine | >=7.0.12<=7.0.14 | |
| Fortinet FortiOS IPS Engine | >=6.4.13<=6.4.15 | |
| Fortinet FortiOS IPS Engine | >=6.4.13<=6.4.15 | |
| Fortinet FortiOS IPS Engine | >=7.0.12<7.0.15 | |
| Fortinet FortiOS IPS Engine | >=7.2.5<7.2.8 | |
| Fortinet FortiOS IPS Engine | >=7.4.0<7.4.4 |
Remedy
Please upgrade to FortiOS version 7.4.4 or above Please upgrade to FortiOS version 7.2.8 or above Please upgrade to FortiOS version 7.0.15 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-36505?
CVE-2024-36505 is classified as a high severity vulnerability due to improper access control.
How do I fix CVE-2024-36505?
To mitigate CVE-2024-36505, upgrade to FortiOS versions 7.4.4 or higher, 7.2.8 or higher, or 7.0.15 or higher.
Who is affected by CVE-2024-36505?
CVE-2024-36505 affects users of FortiOS versions 7.4.0 through 7.4.3, 7.2.5 through 7.2.7, 7.0.12 through 7.0.14, and certain 6.4.x versions.
What type of vulnerability is CVE-2024-36505?
CVE-2024-36505 is an improper access control vulnerability categorized under CWE-284.
Can CVE-2024-36505 be exploited remotely?
Yes, CVE-2024-36505 can potentially be exploited by an attacker who has already obtained write access to the underlying system.
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-36505
- agent/first-publish-date
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/fortiguard-psirt
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- vendor/fortinet
- canonical/fortinet fortios ips engine
- version/fortinet fortios ips engine/7.4.0
- version/fortinet fortios ips engine/7.4.3
- version/fortinet fortios ips engine/7.2.5
- version/fortinet fortios ips engine/7.2.7
- version/fortinet fortios ips engine/7.0.12
- version/fortinet fortios ips engine/7.0.14
- version/fortinet fortios ips engine/6.4.13
- version/fortinet fortios ips engine/6.4.15