Fortinet plugs security holes in several products
Fortinet has released security updates for various products. Attackers can use these to infiltrate malicious code, for example.
(Image: Bild erstellt mit KI in Bing Designer durch heise online / dmk)
Fortinet has released security updates for numerous products. One of the vulnerabilities is considered a critical risk, while two others have a "high" threat level.
The most serious is a security gap in Fortiswitches, which allows attackers to change admin passwords with specially prepared requests from the network without authentication (CVE-2024-48887, CVSS 9.3, risk "critical"). The gap is closed by software versions 6.4.15, 7.0.11, 7.2.9, 7.4.5 or 7.6.1 and newer.
Fortinet: High-risk gaps
In addition, there are insufficient restrictions on desired endpoints in communication channels. This allows attackers in a man-in-the-middle position to impersonate the management interface by intercepting FGFM authentication requests between the actual endpoints. This affects FortiOS, Fortiproxy, Fortimanager, Fortianalyzer, Fortivoice and Fortiweb (CVE-2024-26013, CVE-2024-50565, both CVSS 7.1, risk "high"). In Fortiisolator, attackers with a "super admin" profile and access to the command line can inject code via specially prepared HTTP requests and execute it without authorization, which is due to insufficient filtering of elements (CVE-2024-54024, CVSS 7.0, risk "high").
IT managers should check the new security notifications and download and install the available updates for instances used in their networks or, if necessary, implement the temporary countermeasures available in some cases until an update is possible.
- Fortiswitch - Unverified password change via set_password endpoint, CVE-2024-48887, CVSS 9.3, risk "critical"
- Fortianalyzer, Fortimanager, FortiOS, Fortiproxy, Fortiweb - No certificate name verification for fgfm connection, CVE-2024-26013+CVE-2024-50565, CVSS 7.1, high
- Fortiisolator - OS command injection on diagnose feature (GUI), CVE-2024-54024, CVSS 7.0, high
- Fortiweb - Directory traversal, CVE-2025-25254, CVSS 6.8, medium
- Fortiisolator - OS command injection on gen-ca-cert command, CVE-2024-54025, CVSS 6.5, medium
- Fortiweb - Incorrect user management in widgets dashboard, CVE-2024-46671, CVSS 5.6, medium
- Fortianalyzer and Fortimanager - Log Pollution via login page, CVE-2024-52962, CVSS 5.0, medium
- Forticlient EMS can send javascript code to client through messages, CVE-2025-22855, CVSS 2.6, low
- FortiOS - LDAP Clear-text credentials retrievable with IP modification, CVE-2024-32122, CVSS 2.1, low
Cybercriminals regularly attack security vulnerabilities in Fortinet devices, as these usually allow access to networks. Admins should therefore not hesitate for long, but install the updates quickly.
(dmk)