PT-2024-10341 · Fortinet · Fortirecorder

Published 2024-09-27 · Updated 2025-01-14 · CVE-2024-47566

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fortinet FortiRecorder versions 7.2.0 through 7.2.1 Fortinet FortiRecorder versions prior to 7.0.4

Description The issue is related to a path traversal vulnerability, which allows a privileged attacker to access and delete files from the underlying filesystem by sending crafted CLI requests. This is due to an improper limitation of a pathname to a restricted directory. The vulnerability can be exploited to read, modify, and delete arbitrary files.

Recommendations For Fortinet FortiRecorder versions 7.2.0 through 7.2.1, consider disabling CLI requests until a patch is available. For Fortinet FortiRecorder versions prior to 7.0.4, update to version 7.0.4 or later to resolve the issue. As a temporary workaround, restrict access to the CLI interface to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-00825

CVE-2024-47566

Affected Products

Fortirecorder

References · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-24-401 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47566 · Security Note
• https://bdu.fstec.ru/vul/2025-00825 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47566 · Vendor Advisory
• https://t.me/cvedetector/15264 · Telegram Post
• https://vuldb.com/ru/?id.291523 · Note
• https://twitter.com/CVEnew/status/1879174638879846737 · Twitter Post