CVE-2024-21754
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
Un uso de hash de contraseña con vulnerabilidad de esfuerzo computacional insuficiente [CWE-916] que afecta a FortiOS versión 7.4.3 e inferior, 7.2 todas las versiones, 7.0 todas las versiones, 6.4 todas las versiones y FortiProxy versión 7.4.2 e inferior, 7.2 todas las versiones, 7.0 todas versiones, 2.0, todas las versiones pueden permitir que un atacante privilegiado con perfil de superadministrador y acceso CLI pueda descifrar el archivo de copia de seguridad.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-01-02 CVE Reserved
- 2024-06-11 CVE Published
- 2024-06-12 EPSS Updated
- 2024-06-27 First Exploit
- 2024-08-01 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-916: Use of Password Hash With Insufficient Computational Effort
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://fortiguard.fortinet.com/psirt/FG-IR-23-423 |
| URL | Date | SRC |
|---|---|---|
| https://github.com/CyberSecuritist/CVE-2024-21754-Forti-RCE | 2024-06-27 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Fortinet Search vendor "Fortinet" | FortiProxy Search vendor "Fortinet" for product "FortiProxy" | >= 7.4.0 <= 7.4.2 Search vendor "Fortinet" for product "FortiProxy" and version " >= 7.4.0 <= 7.4.2" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiProxy Search vendor "Fortinet" for product "FortiProxy" | >= 7.2.0 <= 7.2.10 Search vendor "Fortinet" for product "FortiProxy" and version " >= 7.2.0 <= 7.2.10" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiProxy Search vendor "Fortinet" for product "FortiProxy" | >= 7.0.0 <= 7.0.17 Search vendor "Fortinet" for product "FortiProxy" and version " >= 7.0.0 <= 7.0.17" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiProxy Search vendor "Fortinet" for product "FortiProxy" | >= 2.0.0 <= 2.0.14 Search vendor "Fortinet" for product "FortiProxy" and version " >= 2.0.0 <= 2.0.14" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiOS Search vendor "Fortinet" for product "FortiOS" | >= 7.4.0 <= 7.4.3 Search vendor "Fortinet" for product "FortiOS" and version " >= 7.4.0 <= 7.4.3" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiOS Search vendor "Fortinet" for product "FortiOS" | >= 7.2.0 <= 7.2.8 Search vendor "Fortinet" for product "FortiOS" and version " >= 7.2.0 <= 7.2.8" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiOS Search vendor "Fortinet" for product "FortiOS" | >= 7.0.0 <= 7.0.15 Search vendor "Fortinet" for product "FortiOS" and version " >= 7.0.0 <= 7.0.15" | en |
Affected
| ||||||
| Fortinet Search vendor "Fortinet" | FortiOS Search vendor "Fortinet" for product "FortiOS" | >= 6.4.0 <= 6.4.15 Search vendor "Fortinet" for product "FortiOS" and version " >= 6.4.0 <= 6.4.15" | en |
Affected
| ||||||