CVE-2024-54027

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
Fortinet	FortiSandbox	5.0.0; >= 4.4.0, <= 4.4.6; >= 4.2.1, <= 4.2.7; >= 4.0.0, <= 4.0.5; >= 3.2.0, <= 3.2.4; >= 3.1.0, <= 3.1.5; >= 3.0.5, <= 3.0.7

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-327Vendor Advisory

Timeline

Published: Mar 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-540287.8An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95. A specially crafted malformed file CVE-2024-54037.2ASKEY 5G NR Small Cell fails to properly filter user input for certain functionality, allowing remote attackers with administrator privilege CVE-2024-540305.5in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through use after free.CVE-2024-540315.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext A CVE-2024-540329.3Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an CVE-2024-540349.3Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able CVE-2024-540369.3Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an CVE-2024-540378.1Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited CVE-2024-540384.3Adobe Connect versions 12.6, 11.4.7 and earlier are affected by an Improper Access Control vulnerability that could result in a Security fea CVE-2024-540395.4Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an CVE-2024-54049.8An unauthenticated remote attacker can change the admin password in a moneo appliance due to weak password recovery mechanism.CVE-2024-540405.4Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an