PT-2025-41941 · Fortinet · Fortiswitchmanager+3

Published 2025-10-14 · Updated 2025-10-15 · CVE-2024-26008

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.3 and prior to 7.2.7 FortiProxy versions 7.4.0 through 7.4.3 and prior to 7.2.9 FortiPAM versions prior to 1.2.0 FortiSwitchManager versions 7.2.0 through 7.2.3 and 7.0.0 through 7.0.3

Description An improper check or handling of exceptional conditions exists in the fgfm daemon. An unauthenticated attacker can repeatedly reset the fgfm connection by sending crafted SSL encrypted TCP requests.

Recommendations Update FortiOS to version 7.2.7 or later. Update FortiProxy to version 7.2.9 or later. Update FortiPAM to version 1.2.0 or later. Update FortiSwitchManager to a version later than 7.2.3 or 7.0.3.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2024-26008

Affected Products

Fortios

Fortipam

Fortiproxy

Fortiswitchmanager

References · 7

• https://fortiguard.fortinet.com/psirt/FG-IR-24-041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26008 · Security Note
• https://osv.dev/vulnerability/CVE-2024-26008 · Vendor Advisory
• https://twitter.com/CVEnew/status/1978123689934704857 · Twitter Post
• https://t.me/cveNotify/138565 · Telegram Post
• https://t.me/CVEtracker/34866 · Telegram Post
• https://t.me/cveNotify/138853 · Telegram Post