Weak Authentication in csfd daemon
Fortinet PSIRT Advisories
Fortinet PSIRT Contact:
Website: https://fortiguard.fortinet.com/faq/psirt-contact
FG-IR-24-221
Final
1
1
2025-01-14T00:00:00
Current version
2025-01-14T00:00:00
2025-01-14T00:00:00
A Weak Authentication vulnerability [CWE 1390] in FortiOS, FortiPAM and FortiProxy csfd daemon may allow an unauthenticated attacker with access to the Security Fabric interface and port to bruteforce the authentication process in the Security Fabric protocol and take control of the devices of the Fabric.A Weak Authentication vulnerability [CWE 1390] of the same nature in Fortimanager csfd daemon may allow an unauthenticated attacker with access to the Security Fabric interface and port to bypass the authentication process and access a restricted list of features.
None
Execute unauthorized code or commands
None
Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security Team.
FortiAnalyzer 7.6.1
FortiAnalyzer 7.6.0
FortiAnalyzer 7.4.3
FortiAnalyzer 7.4.2
FortiAnalyzer 7.4.1
FortiAnalyzer Cloud 7.4.3
FortiAnalyzer Cloud 7.4.2
FortiAnalyzer Cloud 7.4.1
FortiManager 7.6.1
FortiManager 7.6.0
FortiManager 7.4.3
FortiManager 7.4.2
FortiManager 7.4.1
FortiManager Cloud 7.4.3
FortiManager Cloud 7.4.2
FortiManager Cloud 7.4.1
FortiOS 7.4.4
FortiOS 7.4.3
FortiOS 7.4.2
FortiOS 7.4.1
FortiOS 7.4.0
FortiOS 7.2.8
FortiOS 7.2.7
FortiOS 7.2.6
FortiOS 7.2.5
FortiOS 7.2.4
FortiOS 7.2.3
FortiOS 7.2.2
FortiOS 7.2.1
FortiOS 7.2.0
FortiOS 7.0.15
FortiOS 7.0.14
FortiOS 7.0.13
FortiOS 7.0.12
FortiOS 7.0.11
FortiOS 7.0.10
FortiOS 7.0.9
FortiOS 7.0.8
FortiOS 7.0.7
FortiOS 7.0.6
FortiOS 7.0.5
FortiOS 7.0.4
FortiOS 7.0.3
FortiOS 7.0.2
FortiOS 7.0.1
FortiOS 7.0.0
FortiOS 6.4.16
FortiOS 6.4.15
FortiOS 6.4.14
FortiOS 6.4.13
FortiOS 6.4.12
FortiOS 6.4.11
FortiOS 6.4.10
FortiOS 6.4.9
FortiOS 6.4.8
FortiOS 6.4.7
FortiOS 6.4.6
FortiOS 6.4.5
FortiOS 6.4.4
FortiOS 6.4.3
FortiOS 6.4.2
FortiOS 6.4.1
FortiOS 6.4.0
FortiProxy 7.4.4
FortiProxy 7.4.3
FortiProxy 7.4.2
FortiProxy 7.4.1
FortiProxy 7.4.0
FortiProxy 7.2.10
FortiProxy 7.2.9
FortiProxy 7.2.8
FortiProxy 7.2.7
FortiProxy 7.2.6
FortiProxy 7.2.5
FortiProxy 7.2.4
FortiProxy 7.2.3
FortiProxy 7.2.2
FortiProxy 7.2.1
FortiProxy 7.2.0
FortiProxy 7.0.17
FortiProxy 7.0.16
FortiProxy 7.0.15
FortiProxy 7.0.14
FortiProxy 7.0.13
FortiProxy 7.0.12
FortiProxy 7.0.11
FortiProxy 7.0.10
FortiProxy 7.0.9
FortiProxy 7.0.8
FortiProxy 7.0.7
FortiProxy 7.0.6
FortiProxy 7.0.5
FortiProxy 7.0.4
FortiProxy 7.0.3
FortiProxy 7.0.2
FortiProxy 7.0.1
FortiProxy 7.0.0
FortiProxy 2.0.14
FortiProxy 2.0.13
FortiProxy 2.0.12
FortiProxy 2.0.11
FortiProxy 2.0.10
FortiProxy 2.0.9
FortiProxy 2.0.8
FortiProxy 2.0.7
FortiProxy 2.0.6
FortiProxy 2.0.5
FortiProxy 2.0.4
FortiProxy 2.0.3
FortiProxy 2.0.2
FortiProxy 2.0.1
FortiProxy 2.0.0
Weak Authentication in csfd daemon
CVE-2024-48886
CVE-2024-50563
FortiAnalyzer-7.6.1
FortiAnalyzer-7.6.0
FortiAnalyzer-7.4.3
FortiAnalyzer-7.4.2
FortiAnalyzer-7.4.1
FortiAnalyzer Cloud-7.4.3
FortiAnalyzer Cloud-7.4.2
FortiAnalyzer Cloud-7.4.1
FortiManager-7.6.1
FortiManager-7.6.0
FortiManager-7.4.3
FortiManager-7.4.2
FortiManager-7.4.1
FortiManager Cloud-7.4.3
FortiManager Cloud-7.4.2
FortiManager Cloud-7.4.1
FortiOS-7.4.4
FortiOS-7.4.3
FortiOS-7.4.2
FortiOS-7.4.1
FortiOS-7.4.0
FortiOS-7.2.8
FortiOS-7.2.7
FortiOS-7.2.6
FortiOS-7.2.5
FortiOS-7.2.4
FortiOS-7.2.3
FortiOS-7.2.2
FortiOS-7.2.1
FortiOS-7.2.0
FortiOS-7.0.15
FortiOS-7.0.14
FortiOS-7.0.13
FortiOS-7.0.12
FortiOS-7.0.11
FortiOS-7.0.10
FortiOS-7.0.9
FortiOS-7.0.8
FortiOS-7.0.7
FortiOS-7.0.6
FortiOS-7.0.5
FortiOS-7.0.4
FortiOS-7.0.3
FortiOS-7.0.2
FortiOS-7.0.1
FortiOS-7.0.0
FortiOS-6.4.16
FortiOS-6.4.15
FortiOS-6.4.14
FortiOS-6.4.13
FortiOS-6.4.12
FortiOS-6.4.11
FortiOS-6.4.10
FortiOS-6.4.9
FortiOS-6.4.8
FortiOS-6.4.7
FortiOS-6.4.6
FortiOS-6.4.5
FortiOS-6.4.4
FortiOS-6.4.3
FortiOS-6.4.2
FortiOS-6.4.1
FortiOS-6.4.0
FortiProxy-7.4.4
FortiProxy-7.4.3
FortiProxy-7.4.2
FortiProxy-7.4.1
FortiProxy-7.4.0
FortiProxy-7.2.10
FortiProxy-7.2.9
FortiProxy-7.2.8
FortiProxy-7.2.7
FortiProxy-7.2.6
FortiProxy-7.2.5
FortiProxy-7.2.4
FortiProxy-7.2.3
FortiProxy-7.2.2
FortiProxy-7.2.1
FortiProxy-7.2.0
FortiProxy-7.0.17
FortiProxy-7.0.16
FortiProxy-7.0.15
FortiProxy-7.0.14
FortiProxy-7.0.13
FortiProxy-7.0.12
FortiProxy-7.0.11
FortiProxy-7.0.10
FortiProxy-7.0.9
FortiProxy-7.0.8
FortiProxy-7.0.7
FortiProxy-7.0.6
FortiProxy-7.0.5
FortiProxy-7.0.4
FortiProxy-7.0.3
FortiProxy-7.0.2
FortiProxy-7.0.1
FortiProxy-7.0.0
FortiProxy-2.0.14
FortiProxy-2.0.13
FortiProxy-2.0.12
FortiProxy-2.0.11
FortiProxy-2.0.10
FortiProxy-2.0.9
FortiProxy-2.0.8
FortiProxy-2.0.7
FortiProxy-2.0.6
FortiProxy-2.0.5
FortiProxy-2.0.4
FortiProxy-2.0.3
FortiProxy-2.0.2
FortiProxy-2.0.1
FortiProxy-2.0.0
8.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R
https://fortiguard.fortinet.com/psirt/FG-IR-24-221
Weak Authentication in csfd daemon
Reference>