CVE-2024-21754

low-risk
Published 2024-06-11

A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.

Do I need to act?

~
4.9% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
1
CVSS 1.8/10 Low
LOCAL / HIGH complexity

Affected Products (2)

Affected Vendors

Fortinet

References (2)

Vendor Advisory https://fortiguard.fortinet.com/psirt/FG-IR-23-423
Vendor Advisory https://fortiguard.fortinet.com/psirt/FG-IR-23-423
20
/ 100
low-risk
Severity 5/34 · Minimal
Exploitability 8/34 · Low
Exposure 7/34 · Low