CVE-2024-26009

Name of the Vulnerable Software and Affected Versions: Fortinet FortiOS versions 6.4.0 through 6.4.15 and versions prior to 6.2.16 Fortinet FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and versions prior to 7.0.15 Fortinet FortiPAM versions prior to 1.2.0

Description: An authentication bypass using an alternate path or channel allows an unauthenticated attacker to take control of a managed device via crafted FGFM requests. This is possible if the device is managed by a FortiManager and the attacker knows the FortiManager's serial number.

Recommendations: Fortinet FortiOS versions 6.4.0 through 6.4.15 and versions prior to 6.2.16: Update to a version after 6.2.16 or a later release. Fortinet FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and versions prior to 7.0.15: Update to a version after 7.0.15 or a later release. Fortinet FortiPAM versions prior to 1.2.0: Update to version 1.2.0 or a later release.