CVE-2024-33503
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.
Risk Assessment
An attacker can gain elevated privileges, potentially leading to full compromise of managed network devices and access to sensitive configuration data.
Recommendation
Immediately update FortiManager and FortiManager Cloud to the patched version as recommended by the vendor. Restrict shell access to trusted administrators only.
Original NVD description (English source)
A improper privilege management vulnerability in Fortinet FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalation of privilege via specific shell commands