gagaltotal/cve-2026-24858

GitHubRepository PoCScanner

PoC files

5 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python tool that scans a target for Fortinet web management indicators and optionally sends a user-supplied payload to an arbitrary endpoint. The exploit mode is disabled by default and requires an explicit flag.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Python helper for CVE-2026-24858 that performs a benign Fortinet web management scan and an optional, explicitly gated exploit sender. The exploit mode is disabled by default and requires a user-supplied payload file and the --enable-exploit flag. The code only sends the provided bytes to a user-specified endpoint; it does not contain any concealed executable behavior, credential theft, persistence, or unrelated payloads. No backdoor or deceptive behavior was observed in the reviewed text files.

ClassificationScanner
Model confidence95%
AuthenticationUnknown
Languagespython
Target softwareFortinet FortiWebFortinet FortiOSFortinet FortiAnalyzerFortinet FortiManagerFortinet FortiProxyFortinet FortiNAC-F
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary function of the tool is to scan for Fortinet web management indicators (detect_fortinet). The exploit mode is explicitly disabled by default and requires a user-supplied payload and an explicit flag, making it a generic payload sender rather than a vulnerability-specific exploit. The README describes the tool as a 'helper Python konservatif untuk *memindai*' (conservative Python helper for scanning).

README.md:5cve_2026_24858_tool.py:3cve_2026_24858_tool.py:173-175

Requirements

  • Target must be running a Fortinet web management interface accessible over HTTP/HTTPS.cve_2026_24858_tool.py:32-36
  • For exploit mode, a payload file must be provided and the --enable-exploit flag must be set.cve_2026_24858_tool.py:125-126

Observed behavior

  • Sends an HTTP GET request to the target root path and inspects the response body and Server header for Fortinet-specific strings.cve_2026_24858_tool.py:39cve_2026_24858_tool.py:60-65
  • Checks for HTTP response headers starting with 'x-forti'.cve_2026_24858_tool.py:67-68
  • In exploit mode, reads a binary payload from a file and sends it as an HTTP POST request to a user-specified endpoint.cve_2026_24858_tool.py:181-183cve_2026_24858_tool.py:83
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Gating
Exploit mode requires --enable-exploit flag and a user-supplied payload fileThe exploit sender is explicitly disabled by default and will exit with an error if the flag is not provided, preventing accidental or hidden execution.cve_2026_24858_tool.py:173-175cve_2026_24858_tool.py:125-126
Payload Handling
Payload is read from a user-specified file and sent as raw bytes via HTTP POSTThe tool does not generate, modify, or interpret the payload; it acts as a simple HTTP client for user-provided data.cve_2026_24858_tool.py:181-183cve_2026_24858_tool.py:73-83
Network Activity
HTTP GET to target root for scanning; HTTP POST to user-specified endpoint for exploitAll network activity is directed at the user-provided target and endpoint; no external callbacks or unrelated connections are present.cve_2026_24858_tool.py:36-39cve_2026_24858_tool.py:77-83
Review boundaries

What the analysis did not establish

  • One non-text media file (666689 bytes) was not analyzed; it is a screenshot referenced in the README.
  • One text file (LICENSE) was omitted from the packet content.
  • The exploit mode does not contain any CVE-2026-24858-specific logic; it is a generic HTTP POST sender.
  • One non-text media file (Screenshot from 2026-02-11 01-17-03.png, 666,689 bytes) was flagged as metadata-only and not analyzed; it could contain hidden data, but no code references or loads it.
  • One unclassified file (315 bytes) was not analyzed; its content and purpose are unknown.
  • One text file (likely a license or similar) was omitted from the packet; its content was not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1