Vulnerability · Published Jun 11, 2024 · Assigned by fortinet
CVE-2024-21754
Low 1.7
In plain English
A low-severity security flaw in FortiOS from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiProxy | 7.4.0 – through 7.4.27.2.0 – through 7.2.107.0.0 – through 7.0.172.0.0 – through 2.0.14 |
| Fortinet | FortiOS | 7.4.0 – through 7.4.37.2.0 – through 7.2.87.0.0 – through 7.0.156.4.0 – through 6.4.15 |
Weakness: CWE-916 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N/E:F/RL:X/RC:R