Authentication Flaw in Fortinet FortiOS and FortiProxy Affecting Multiple Versions
CVE-2024-52965

6.8MEDIUM

Key Information:

Vendor

Fortinet
Status
FortiOS
Fortiproxy
Vendor
CVE Published:
8 July 2025

What is CVE-2024-52965?

An authentication vulnerability exists in Fortinet's FortiOS and FortiProxy products, where an API user can authenticate using an API key combined with a PKI user certificate, even if the provided certificate is invalid. This flaw affects multiple versions of FortiOS and FortiProxy, allowing for potentially unauthorized access to the system. Organizations using these versions should assess their security posture and apply the necessary updates to mitigate potential risks.

Affected Version(s)

FortiOS 7.6.0 <= 7.6.1

FortiOS 7.4.0 <= 7.4.5

FortiOS 7.2.0 <= 7.2.10

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-511

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-52965 : Authentication Flaw in Fortinet FortiOS and FortiProxy Affecting Multiple Versions