Fortinet Security Updates – 11 September 2024

The addressed vulnerabilities could allow the attacker to perform brute force attacks, obtain sensitive information, conduct man-in-the-middle attacks, retrieve or delete arbitrary files from the underlying filesystem, execute limited and temporary commands on the underlying database, and gain access to the affected products.

Sample of the addressed vulnerabilities:

1. FortiSOAR Improper Authorization Vulnerability (CVE-2024-4863):

• CVSS: 7.1
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: Low
• User Interaction: None
• Consequences: Improper access control

2. FortiClientEMS Command Injection Vulnerability (CVE-2024-33508):

• CVSS: 6.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Command Injection

The affected products:

• FortiSOAR.
• FortiADC.
• FortiClientWindows, FortiClientLinux and FortiClientMac.
• FortiClientAndroid, FortiClientiOS.
• FortiAnalyzer and FortiAnalyzer-BigData.
• FortiManager.
• FortiSandbox.
• FortiClientiOS.
• FortiClientEMS and FortiClientEMS Cloud.