Skip to content
fr Sign in
7.1 High

CVE-2024-26013 A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS…

Description

A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15 and before 6.2.16, Fortinet FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.9 and before 7.0.15, Fortinet FortiManager version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiAnalyzer version 7.4.0 through 7.4.2, 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.14 and before 6.2.13, Fortinet FortiVoice version 7.0.0 through 7.0.2 before 6.4.8 and Fortinet FortiWeb before 7.4.2 may allow an unauthenticated attacker in a man-in-the-middle position to impersonate the management device (FortiCloud server or/and in certain conditions, FortiManager), via intercepting the FGFM authentication request between the management device and the managed device

Affected products and versions

Product Affected versions Fixed in
FortiProxy 7.4 7.4.0 → 7.4.2 No fix stated
FortiProxy 7.2 7.2.0 → 7.2.9 No fix stated
FortiProxy 7.0 7.0.0 → 7.0.15 No fix stated
FortiProxy 2.0 2.0.0 → 2.0.14 No fix stated
FortiManager 7.4 7.4.0 → 7.4.2 No fix stated
FortiManager 7.2 7.2.0 → 7.2.4 No fix stated
FortiManager 7.0 7.0.0 → 7.0.11 No fix stated
FortiManager 6.4 6.4.0 → 6.4.14 No fix stated
FortiManager 6.2 6.2.0 → 6.2.13 No fix stated
Show the 5 other branches
Product Affected versions Fixed in
FortiOS 7.4 7.4.0 → 7.4.3 No fix stated
FortiOS 7.2 7.2.0 → 7.2.7 No fix stated
FortiOS 7.0 7.0.0 → 7.0.14 No fix stated
FortiOS 6.4 6.4.0 → 6.4.15 No fix stated
FortiOS 6.2 6.2.0 → 6.2.16 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FortiProxy

The 110 CVEs of FortiProxy →
CVE-2026-106175 A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions,… 2.1 Low CVE-2026-84392 A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all… 2.5 Low CVE-2026-84393 A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6,… 7.3 High CVE-2026-71407 A Stack-based Buffer Overflow vulnerability [CWE-121] vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6 may allow an… 5.1 Medium
Track this CVE