CVE-2024-33507

HIGH

Fortinet Fortiisolator < 2.4.5 - Insufficient Session Expiration

Title source: rule

Description

An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.

References (1)

[Vendor Advisory] https://fortiguard.fortinet.com/psirt/FG-IR-24-062

Scores

CVSS v3 7.4

EPSS 0.0012

EPSS Percentile 30.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-613

Status published

Products (1)

fortinet/fortiisolator 2.3.0 - 2.4.5

Published Oct 14, 2025

Tracked Since Feb 18, 2026