Detections
Analytics

FortiOS 7.0.x < 7.0.13 / 7.2.x < 7.2.6 / 7.4.x < 7.4.2 Remote Code Execution

critical Web App Scanning Plugin ID 114795

Language:

Synopsis

FortiOS 7.0.x < 7.0.13 / 7.2.x < 7.2.6 / 7.4.x < 7.4.2 Remote Code Execution

Description

FortiOS version 6.0.x prior to 6.0.16 or 6.2.x prior to 6.2.15 or 6.4.x prior to 6.4.14 or 7.0.x prior to 7.0.13 or 7.2.x prior to 7.2.6 or 7.4.x prior to 7.4.2 and FortiProxy version 7.0.x prior to 7.0.14 or 7.2.x prior to 7.2.8 or 7.4.x prior to 7.4.2 are affected by a vulnerability allowing allows a remote attacker to execute arbitrary code or command through a specially crafted request.

Solution

Upgrade to FortiOS 6.0.17, 6.2.15, 6.4.14, 7.0.13, 7.2.6, 7.4.2 or later.

See Also

https://fortiguard.com/psirt/FG-IR-24-015

Plugin Details

Severity: Critical

ID: 114795

Type: remote

Published: 5/22/2025

Updated: 5/22/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2024-21762

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2024-21762

Vulnerability Information

CPE: cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/7/2024

Vulnerability Publication Date: 2/7/2024

CISA Known Exploited Vulnerability Due Dates: 2/16/2024

Reference Information

CVE: CVE-2024-21762