CVE-2024-26013
Description
A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2 before 6.4.8 and Fortinet FortiWeb before 7.4.2 may allow an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device
How to fix
- fortinet fortianalyzer6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 or later
- fortinet fortimanager6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 or later
- fortinet fortios7.0.16, 7.2.9, 7.4.5 or later
- fortinet fortiproxy7.0.16, 7.2.10, 7.4.3 or later
- fortinet fortivoice6.4.9, 7.0.3 or later
- fortinet fortiweb7.4.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fortinet fortianalyzer | 6.2.0 ≤ v < 6.2.14, 6.4.0 ≤ v < 6.4.15, 7.0.0 ≤ v < 7.0.12, 7.2.0 ≤ v < 7.2.5, 7.4.0 ≤ v < 7.4.3 | 6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 |
| fortinet fortimanager | 6.2.0 ≤ v < 6.2.14, 6.4.0 ≤ v < 6.4.15, 7.0.0 ≤ v < 7.0.12, 7.2.0 ≤ v < 7.2.5, 7.4.0 ≤ v < 7.4.3 | 6.2.14, 6.4.15, 7.0.12, 7.2.5, 7.4.3 |
| fortinet fortios | 6.4.0 ≤ v < 7.0.16, 7.2.0 ≤ v < 7.2.9, 7.4.0 ≤ v < 7.4.5 | 7.0.16, 7.2.9, 7.4.5 |
| fortinet fortiproxy | 2.0.0 ≤ v < 7.0.16, 7.2.0 ≤ v < 7.2.10, 7.4.0 ≤ v < 7.4.3 | 7.0.16, 7.2.10, 7.4.3 |
| fortinet fortivoice | 6.0.0 ≤ v < 6.4.9, 7.0.0 ≤ v < 7.0.3 | 6.4.9, 7.0.3 |
| fortinet fortiweb | 7.4.0 ≤ v < 7.4.3 | 7.4.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.