CVEvulnerability

CVE-2024-21757

7.8 HIGH Published 2024-08-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-620

Description

A unverified password change in Fortinet FortiManager versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, as well as Fortinet FortiAnalyzer versions 7.0.0 through 7.0.10, versions 7.2.0 through 7.2.4, and versions 7.4.0 through 7.4.1, allows an attacker to modify admin passwords via the device configuration backup.

Affected configurations

• fortinet fortianalyzer (>= 7.0.0 < 7.0.11) • fortinet fortianalyzer (>= 7.2.0 < 7.2.5) • fortinet fortianalyzer (>= 7.4.0 < 7.4.2) • fortinet fortimanager (>= 7.0.0 < 7.0.11) • fortinet fortimanager (>= 7.2.0 < 7.2.5) • fortinet fortimanager (>= 7.4.0 < 7.4.2)

Related

Weakness · CWE (1)

  • CWE-620 Unverified Password Change weakness

References