CVEvulnerability
CVE-2024-40593
4.4 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-11
- Last modified
- 2026-10-02
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
- CVSS 3.1 ([email protected])
- 4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-320
Description
A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.
Affected configurations
• fortinet fortianalyzer (>= 6.4.0 < 7.2.6)
• fortinet fortianalyzer (>= 7.4.0 < 7.4.3)
• fortinet fortimanager (>= 6.4.0 < 7.2.6)
• fortinet fortimanager (>= 7.4.0 < 7.4.3)
• fortinet fortios 7.0.14
• fortinet fortios 7.2.7
• fortinet fortios 7.4.4
• fortinet fortios 7.6.0
• fortinet fortiportal (>= 6.0.0 <= 6.0.15)
Related
Weakness · not in database (1)
References
- https://fortiguard.fortinet.com/psirt/FG-IR-24-133 Vendor Advisory