PT-2025-32871 · Fortinet · Fortirecorder+4

Published 2025-08-12 · Updated 2025-08-13 · CVE-2024-40588

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Fortinet FortiMail versions 7.6.0 through 7.6.1 and prior to 7.4.3 Fortinet FortiVoice versions 7.0.0 through 7.0.5 and prior to 7.4.9 Fortinet FortiRecorder versions 7.2.0 through 7.2.1 and prior to 7.0.4 Fortinet FortiCamera versions 7.6.0 and prior to 7.4.6 Fortinet FortiNDR versions 7.6.0 and prior to 7.4.6

Description: Multiple relative path traversal vulnerabilities exist in several Fortinet products. A privileged attacker may be able to read files from the underlying filesystem by sending crafted CLI requests.

Recommendations: Fortinet FortiMail versions prior to 7.4.3 should be updated. Fortinet FortiMail versions 7.6.0 through 7.6.1 should be updated. Fortinet FortiVoice versions prior to 7.4.9 should be updated. Fortinet FortiVoice versions 7.0.0 through 7.0.5 should be updated. Fortinet FortiRecorder versions prior to 7.0.4 should be updated. Fortinet FortiRecorder versions 7.2.0 through 7.2.1 should be updated. Fortinet FortiCamera versions prior to 7.4.6 should be updated. Fortinet FortiCamera version 7.6.0 should be updated. Fortinet FortiNDR versions prior to 7.4.6 should be updated. Fortinet FortiNDR version 7.6.0 should be updated.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-40588

Affected Products

Forticamera

Fortimail

Fortindr

Fortirecorder

Fortivoice

References · 5

• https://fortiguard.fortinet.com/psirt/FG-IR-24-309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40588 · Security Note
• https://osv.dev/vulnerability/CVE-2024-40588 · Vendor Advisory
• https://t.me/cveNotify/131929 · Telegram Post
• https://twitter.com/CVEnew/status/1955535858746155342 · Twitter Post