CVE-2024-40591CWE-266

An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows…

High · published February 11, 2025

CVSS v3.1
8.0
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
CVSS v4.0
Not supplied
EPSS
0.00621 · 49.1th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-02-11T16:09Z
EPSS history
Timeline
  • 11 FEB 16:09Z
    An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows…
    cvelistv5