CVE-2024-26010

HighCVSS 7.5/10Last modified Oct 22, 2026

Description

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.1 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.7; >= 7.0.0, <= 7.0.14; >= 6.4.0, <= 6.4.16; >= 6.2.0, <= 6.2.17; >= 6.0.0, <= 6.0.18
Fortinet	FortiSwitchManager	>= 7.2.0, <= 7.2.3; >= 7.0.1, <= 7.0.3
Fortinet	FortiPAM	1.2.0; >= 1.1.0, <= 1.1.2; >= 1.0.0, <= 1.0.3
Fortinet	FortiProxy	>= 7.4.0, <= 7.4.3; >= 7.2.0, <= 7.2.9; >= 7.0.0, <= 7.0.16; >= 2.0.0, <= 2.0.14; >= 1.2.1, <= 1.2.13; 01.02.00; >= 1.1.4, <= 1.1.6; >= 01.01.00, <= 01.01.03; >= 01.00.00, <= 01.00.07

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-036Vendor Advisory
https://fortiguard.fortinet.com/psirt/FG-IR-24-036Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Oct 22, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-260119.8A missing authentication for critical function vulnerability in Fortinet FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.4,CVE-2024-260127.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiAP-S 6.2 all verisons, and 6.4 CVE-2024-260137.5A improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in Fortinet FortiOS version 7.4.0 through 7.4.CVE-2024-260154.7An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and be CVE-2024-260165.4A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata,CVE-2024-260176.7Uncontrolled search path in some Intel(R) Rendering Toolkit software before version 2024.1.0 may allow an authenticated user to potentially CVE-2024-260186.1Cross-site scripting vulnerability exists in TvRock 0.9t8a. An arbitrary script may be executed on the web browser of the user accessing the CVE-2024-260195.4Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitr CVE-2024-26027.8CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code CVE-2024-260208.8An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead CVE-2024-260212.3Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially CVE-2024-260227.8Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated user to potentially en