Vulnerability · Published Aug 12, 2025 · Assigned by fortinet
CVE-2024-40588
Medium 4.2
In plain English
A medium-severity security flaw in FortiCamera from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Official description
Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiCamera 2.0.0, FortiCamera 1.1 all versions, FortiCamera 1.0 all versions, FortiMail 7.6.0 through 7.6.1, FortiMail 7.4.0 through 7.4.3, FortiMail 7.2 all versions, FortiMail 7.0 all versions, FortiMail 6.4 all versions, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.6, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiRecorder 6.4 all versions, FortiVoice 7.0.0 through 7.0.3, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiCamera | 2.1.0 – through 2.1.42.0.01.1.0 – through 1.1.51.0.3 – through 1.0.5 |
| Fortinet | FortiNDR | 7.6.0 – through 7.6.17.4.0 – through 7.4.67.2.0 – through 7.2.57.1.0 – through 7.1.17.0.0 – through 7.0.7 |
| Fortinet | FortiMail | 7.6.0 – through 7.6.17.4.0 – through 7.4.37.2.0 – through 7.2.97.0.0 – through 7.0.96.4.0 – through 6.4.8 |
| Fortinet | FortiRecorder | 7.2.0 – through 7.2.17.0.0 – through 7.0.46.4.0 – through 6.4.6 |
| Fortinet | FortiVoice | 7.0.0 – through 7.0.36.4.0 – through 6.4.96.0.0 – through 6.0.12 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:P/RL:X/RC:C