CVE-2024-48886CWE-1390

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions…

High · published January 14, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

⚡ A weak authentication vulnerability in Fortinet FortiOS means attackers can brute-force their way in! Think of it like a restaurant with a poorly secured back door — it might be locked, but if the lock is flimsy, anyone determined enough can get in without a reservation. If exploited, an attacker could execute unauthorized commands or code, potentially leading to data breaches or system takeovers. This could result in devastating impacts on your network security and integrity, opening the floodgates for more malicious activities.

Put simply

Think of it like a restaurant with a poorly secured back door — it might be locked, but if the lock is flimsy, anyone determined enough can get in without a reservation. The vulnerability exists due to weak authentication mechanisms in multiple Fortinet products, allowing attackers to perform brute-force attacks and gain unauthorized access to the system.

What to do

If exploited, an attacker could execute unauthorized commands or code, potentially leading to data breaches or system takeovers. This could result in devastating impacts on your network security and integrity, opening the floodgates for more malicious activities. Immediate action is crucial! Update FortiOS to version 7.4.5 or later, and ensure all other affected Fortinet products are also patched. Enhance your authentication methods to include strong passwords and multi-factor authentication where possible. You've got this! Follow these steps, and you'll reinforce your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R
CVSS v4.0
Not supplied
EPSS
0.00476 · 40.1th percentile
Weakness
CWE-1390 · Weak Authentication
Published
2025-01-14T14:09Z
EPSS history
Timeline
  • 14 JAN 14:09Z
    A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions…
    cvelistv5