Recently modified vulnerabilities for "fortinet fortiswitchmanager" 7.2.3

Where

AND

Sort:

Fortinet FortiOSFGFM protocol allows unauthenticated reset of the connection

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C

An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-26008

Fortinet FortiOSFortiOS - Improper authentication in fgfmd

Risk 86

Severity

9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4, FortiManager 7.0.0 through 7.0.11, FortiManager 6.4.0 through 6.4.14, FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiPortal 6.0.0 through 6.0.14, FortiPortal 5.3 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-26011

Fortinet FortiOSBuffer overflow in fgfmd

Risk 69

Severity

7.5

Buffer Overflow

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:W/RC:C

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.1 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

1 / 2

Source: MITRE

First published (updated )

CVE-2024-26010

Fortinet FortiOSFortinet Multiple Products Format String Vulnerability

Risk 77

Severity

9.8

Zeroday

EPSS

0.09%

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

1 / 3

Source: MITRE

First published (updated )

CVE-2024-23113

Fortinet FortiOSWeak authentication - FGFM protocol

Risk 75

Severity

8.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.15, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.0 through 7.0.3 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

1 / 2

Source: MITRE

Remedy

Upgrade to FortiSwitchManager version 7.2.4 or above Upgrade to FortiSwitchManager version 7.0.4 or above Upgrade to FortiOS version 6.4.16 or above Upgrade to FortiOS version 6.2.17 or above Upgrade to FortiManager version 7.0.12 or above Upgrade to FortiManager version 6.4.15 or above Upgrade to FortiPAM version 1.3.0 or above Upgrade to FortiProxy version 7.4.3 or above Upgrade to FortiProxy version 7.2.9 or above Upgrade to FortiProxy version 7.0.16 or above

First published (updated )

CVE-2024-26009

Fortinet FortiManagerFortiOS - Improper authentication in fgfmd

Risk 27

Severity

5.2

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:U/RC:C

An improper authentication vulnerability [CWE-287] in FortiManager, FortiOS, FortiPAM, FortiPortal, FortiProxy and FortiSwitchManager fgfmd daemon may allow an unauthenticated attacker to inject (but not receive) packets in tunnels established between a FortiManager and the targeted device.

First published (updated )

Advisory

FG-IR-24-032

Trending

Fortinet FortiOSFGFM protocol allows unauthenticated reset of the connection

Fortinet FortiOSFortiOS - Improper authentication in fgfmd

Fortinet FortiOSBuffer overflow in fgfmd

Fortinet FortiOSFortinet Multiple Products Format String Vulnerability

Fortinet FortiOSWeak authentication - FGFM protocol

Remedy

Fortinet FortiManagerFortiOS - Improper authentication in fgfmd

Company

Resources

Contact