PT-2025-32873 · Fortinet · Fortimanager+1

Published 2025-08-12 · Updated 2025-08-13 · CVE-2024-52964

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiManager versions 7.6.0 through 7.6.1 Fortinet FortiManager versions 7.4.0 through 7.4.5 Fortinet FortiManager versions 7.2.0 through 7.2.9 Fortinet FortiManager versions prior to 7.0.13 Fortinet FortiManager Cloud versions 7.6.0 through 7.6.1 Fortinet FortiManager Cloud versions 7.4.0 through 7.4.5 Fortinet FortiManager Cloud versions prior to 7.2.9

Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability allows an authenticated remote attacker to overwrite arbitrary files via crafted FGFM requests.

Recommendations: Fortinet FortiManager versions 7.6.0 through 7.6.1: Update to a newer version. Fortinet FortiManager versions 7.4.0 through 7.4.5: Update to a newer version. Fortinet FortiManager versions 7.2.0 through 7.2.9: Update to a newer version. Fortinet FortiManager versions prior to 7.0.13: Update to a newer version. Fortinet FortiManager Cloud versions 7.6.0 through 7.6.1: Update to a newer version. Fortinet FortiManager Cloud versions 7.4.0 through 7.4.5: Update to a newer version. Fortinet FortiManager Cloud versions prior to 7.2.9: Update to a newer version.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-09922

CVE-2024-52964

Affected Products

Fortimanager

Fortimanager Cloud

References · 6

• https://bdu.fstec.ru/vul/2025-09922 · Security Note
• https://fortiguard.fortinet.com/psirt/FG-IR-24-473 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52964 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52964 · Security Note
• https://twitter.com/CVEnew/status/1955535851708150227 · Twitter Post
• https://t.me/cveNotify/131931 · Telegram Post