CVE-2024-35277

HIGH

FortiManager 6.4.0-6.4.14, 7.0.0-7.0.12, 7.2.0-7.2.5, 7.4.0-7.4.2 - Unauthenticated Access to Config

Title source: llm
STIX 2.1

Description

A missing authentication for critical function in Fortinet FortiPortal version 6.0.0 through 6.0.15, FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14 allows attacker to access to the configuration of the managed devices by sending specifically crafted packets

References (1)

Core 1
Core References

Scores

CVSS v3 8.6
EPSS 0.0020
EPSS Percentile 41.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (2)
fortinet/fortimanager 6.4.0 - 6.4.15
fortinet/fortimanager_cloud 7.0.1 - 7.0.13
Published Jan 14, 2025
Tracked Since Feb 18, 2026