PT-2025-2687 · Fortinet · Fortideceptor

Published 2025-01-14 · Updated 2026-02-04 · CVE-2024-45326

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions FortiDeceptor versions 6.0.0, 5.3.3 and below, 5.2.1 and below, 5.1.0, 5.0.0

Description The issue is related to improper access control, which may allow an authenticated attacker with no privileges to perform operations on the central management appliance via crafted requests. This could potentially enable a remote attacker to elevate their privileges by sending specially crafted requests.

Recommendations For FortiDeceptor version 6.0.0, update to a version that includes a fix for this issue. For FortiDeceptor versions 5.3.3 and below, consider disabling access to the central management appliance until a patch is available. For FortiDeceptor versions 5.2.1 and below, restrict access to the device to minimize the risk of exploitation. For FortiDeceptor versions 5.1.0 and 5.0.0, avoid using the device for critical operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-01315

CVE-2024-45326

Affected Products

Fortideceptor

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-45326 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-285 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45326 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01315 · Security Note
• https://t.me/cvedetector/15268 · Telegram Post
• https://twitter.com/0dayPublishing/status/2019051182132510847 · Twitter Post
• https://t.me/cveNotify/150840 · Telegram Post
• https://twitter.com/CVEnew/status/1879174628201132308 · Twitter Post