CVE-2024-45331

HighCVSS 7.3

Published: 16/01/2025(UTC)Updated: 08/07/2026(UTC)Translated: 09/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A privilege escalation vulnerability in Fortinet FortiAnalyzer and FortiManager allows an attacker to escalate privileges via specific shell commands. The flaw is due to incorrect privilege assignment in multiple versions of these products.

Risk Assessment

An attacker with low privileges can gain unauthorized administrative access, leading to full device compromise and potential takeover of managed network infrastructure.

Recommendation

Immediately update FortiAnalyzer and FortiManager to patched versions. In the meantime, restrict shell access to trusted administrators only.

Other vulnerabilities in FortiAnalyzer / FortiManager

CVE-2024-35276Medium
A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer and FortiManager allows a remote attacker to execute unauthorized code or commands via specially crafted packets. The issue affects multiple versions of these products, including cloud variants.

Original NVD description (English source)

A incorrect privilege assignment vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.2, FortiAnalyzer Cloud 7.2.1 through 7.2.6, FortiAnalyzer Cloud 7.0 all versions, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions allows attacker to escalate privilege via specific shell commands

Vulnerability data from NVD (NIST) · CISA KEV · EPSS