PT-2025-41942 · Fortinet · Fortiisolator

Published 2025-10-14 · Updated 2025-10-14 · CVE-2024-33507

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FortiIsolator versions 2.0 through 2.4.4 FortiIsolator version 2.3 all versions FortiIsolator version 2.2.0 FortiIsolator version 2.1 all versions

Description FortiIsolator is affected by an insufficient session expiration and an incorrect authorization issue. These flaws may allow a remote unauthenticated attacker to deauthenticate logged-in administrators through a crafted cookie. Additionally, a remote authenticated read-only attacker could gain write privileges using a crafted cookie.

Recommendations Update FortiIsolator to a version later than 2.4.4. Update FortiIsolator to a version later than 2.3 all versions. Update FortiIsolator to a version later than 2.2.0. Update FortiIsolator to a version later than 2.1 all versions.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2024-33507

Affected Products

Fortiisolator

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-33507 · Security Note
• https://osv.dev/vulnerability/CVE-2024-33507 · Vendor Advisory
• https://fortiguard.fortinet.com/psirt/FG-IR-24-062 · Vendor Advisory
• https://t.me/cveNotify/138566 · Telegram Post
• https://twitter.com/CveTodo/status/1978135907887644904 · Twitter Post
• https://twitter.com/CVEnew/status/1978123686046560575 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1978141993332039694 · Twitter Post
• https://t.me/CVEtracker/34870 · Telegram Post