PT-2025-2453 · Fortinet · Fortios

Published 2025-01-14 · Updated 2025-07-22 · CVE-2024-36504

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: FortiOS SSLVPN web portal versions 6.4 through 7.0, versions 7.2.0 through 7.2.8, and versions 7.4.0 through 7.4.4

Description: The issue is related to an out-of-bounds read vulnerability that may allow an authenticated attacker to perform a denial of service on the SSLVPN web portal via a specially crafted URL. This vulnerability does not impact the SSL VPN tunnel mode.

Recommendations: For versions 6.4, update to a version that is not affected by this issue. For versions 7.0, update to a version that is not affected by this issue. For versions 7.2.0 through 7.2.8, update to a version that is not affected by this issue. For versions 7.4.0 through 7.4.4, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to the SSLVPN web portal until a patch is available.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2025-08809

CVE-2024-36504

Affected Products

Fortios

References · 9

• https://fortiguard.fortinet.com/psirt/FG-IR-23-473 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08809 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36504 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36504 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36504 · Vendor Advisory
• https://fortiguard.com/psirt/FG-IR-23-473 · Note
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://twitter.com/CVEnew/status/1879174625697108070 · Twitter Post
• https://t.me/cveNotify/129899 · Telegram Post