PT-2025-2437 · Fortinet · Fortianalyzer+1

Published 2025-01-14 · Updated 2025-01-15 · CVE-2024-35273

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.4.0 through 7.4.2 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2

Description: The issue is related to an out-of-bounds write that allows an attacker to escalate privileges via specially crafted HTTP requests. This can potentially enable a remote attacker to execute arbitrary code or commands.

Recommendations: For Fortinet FortiManager versions 7.4.0 through 7.4.2, consider disabling the handling of specially crafted HTTP requests until a patch is available. For Fortinet FortiAnalyzer versions 7.4.0 through 7.4.2, restrict access to the vulnerable proxy server daemon to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-01509

CVE-2024-35273

Affected Products

Fortianalyzer

Fortimanager

References · 6

• https://fortiguard.fortinet.com/psirt/FG-IR-24-106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35273 · Security Note
• https://bdu.fstec.ru/vul/2025-01509 · Security Note
• https://osv.dev/vulnerability/CVE-2024-35273 · Vendor Advisory
• https://twitter.com/CVEnew/status/1879174647176159675 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Reddit Post