Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2024-50568

A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 throu

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fortinet

Description

A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 & FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Fortinet FortiOS

Default version status: unaffected

  • 7.4.0 to ≤ 7.4.3affected
  • 7.2.0 to ≤ 7.2.7affected
  • 7.0.0 to ≤ 7.0.14affected
  • 6.4.2 to ≤ 6.4.16affected

Fortinet FortiProxy

Default version status: unaffected

  • 7.4.0 to ≤ 7.4.3affected
  • 7.2.0 to ≤ 7.2.9affected
  • 7.0.0 to ≤ 7.0.16affected

References