Authentication Bypass in Fortinet FortiOS, FortiProxy, and FortiPAM

CVE-2024-26009

What is CVE-2024-26009?

An authentication bypass vulnerability exists in Fortinet's FortiOS, FortiProxy, and FortiPAM products, allowing unauthenticated attackers to potentially gain control of managed devices. This vulnerability arises when crafted FGFM requests are sent to devices managed by FortiManager, particularly if the attacker has the FortiManager’s serial number. The issue affects specific versions of FortiOS, FortiProxy, and FortiPAM. It is crucial for organizations to review their systems and apply necessary security measures to mitigate this risk.

References