SB2025041046 - Multiple vulnerabilities in Fortinet products

Description

This security bulletin contains information about 2 vulnerabilities.

1) Weak authentication (CVE-ID: CVE-2024-50563)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to weak authentication in csfd daemon. An unauthenticated attacker with access to the security fabric interface and port can bypass the authentication process and access a restricted list of features.

2) Weak authentication (CVE-ID: CVE-2024-48886)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to weak authentication in csfd daemon. An unauthenticated attacker with access to the security fabric interface and port can bypass the authentication process and access a restricted list of features.

Remediation

Install update from vendor's website.

References

• https://www.fortiguard.com/psirt/FG-IR-24-221