PT-2025-6259 · Fortinet · Fortianalyzer+4

Published 2025-02-11 · Updated 2025-02-13 · CVE-2024-40584

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 6.2.2 through 6.2.13 Fortinet FortiAnalyzer versions 6.4.0 through 6.4.15 Fortinet FortiAnalyzer versions 7.0.0 through 7.0.13 Fortinet FortiAnalyzer versions 7.2.0 through 7.2.5 Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3 Fortinet FortiAnalyzer BigData version 6.2.5 Fortinet FortiAnalyzer BigData versions 6.4.5 through 6.4.7 Fortinet FortiAnalyzer BigData versions 7.0.1 through 7.0.6 Fortinet FortiAnalyzer BigData versions 7.2.0 through 7.2.7 Fortinet FortiAnalyzer BigData version 7.4.0 Fortinet FortiAnalyzer Cloud versions 6.4.1 through 6.4.7 Fortinet FortiAnalyzer Cloud versions 7.0.1 through 7.0.13 Fortinet FortiAnalyzer Cloud versions 7.2.1 through 7.2.5 Fortinet FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 Fortinet FortiManager versions 6.2.2 through 6.2.13 Fortinet FortiManager versions 6.4.0 through 6.4.15 Fortinet FortiManager versions 7.0.0 through 7.0.13 Fortinet FortiManager versions 7.2.0 through 7.2.5 Fortinet FortiManager versions 7.4.0 through 7.4.3 Fortinet FortiManager Cloud versions 6.4.1 through 6.4.7 Fortinet FortiManager Cloud versions 7.0.1 through 7.0.13 Fortinet FortiManager Cloud versions 7.2.1 through 7.2.5 Fortinet FortiManager Cloud versions 7.4.1 through 7.4.3

Description: The vulnerability exists due to the improper neutralization of special elements used in an OS command. This allows an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTPS or HTTP requests.

Recommendations: As a temporary workaround, consider disabling the vulnerable GUI components until a patch is available. Restrict access to the vulnerable FortiAnalyzer and FortiManager modules to minimize the risk of exploitation. Avoid using the vulnerable FortiAnalyzer BigData and FortiManager Cloud versions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-01606

CVE-2024-40584

Affected Products

Fortianalyzer

Fortianalyzer-Bigdata

Fortianalyzer Cloud

Fortimanager

Fortimanager Cloud

References · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-24-220 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01606 · Security Note
• https://osv.dev/vulnerability/CVE-2024-40584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40584 · Security Note
• https://reddit.com/r/k12cybersecurity/comments/1inr1ei/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://twitter.com/CVEnew/status/1889355104022667647 · Twitter Post
• https://reddit.com/r/k12cybersecurity/comments/1ioj9rb/updated_msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cvedetector/17729 · Telegram Post