CVE-2024-48886
Published: 14 January 2025
Summary
CVE-2024-48886 is a critical-severity Weak Authentication (CWE-1390) vulnerability in Fortinet Fortiproxy. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked in the top 31.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-7 (Unsuccessful Logon Attempts) and IA-5 (Authenticator Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-7 enforces limits on unsuccessful logon attempts, directly thwarting brute-force attacks that exploit weak authentication to execute unauthorized code.
IA-5 requires management of authenticators with sufficient strength of mechanism, mitigating brute-force vulnerabilities in weak authentication implementations.
SI-2 mandates timely flaw remediation, including patching the specific weak authentication vulnerability described in CVE-2024-48886.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Weak auth vuln directly enables brute-force (T1110) against public-facing Fortinet services to obtain valid accounts (T1078) and execute code/commands (T1190).
NVD Description
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through…
more
7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.
Deeper analysisAI
CVE-2024-48886 is a weak authentication vulnerability present in several Fortinet products, including FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, and 6.4.0 through 6.4.15; FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, and 2.0.0 through 2.0.14; FortiManager versions 7.6.0 through 7.6.1 and 7.4.1 through 7.4.3; FortiManager Cloud versions 7.4.1 through 7.4.3; and FortiAnalyzer Cloud versions 7.4.1 through 7.4.3. The flaw, associated with CWE-1390 and NVD-CWE-Other, enables attackers to execute unauthorized code or commands through a brute-force attack. It carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
A remote, unauthenticated attacker can exploit this vulnerability over the network by performing a brute-force attack, which requires high attack complexity but no user interaction. Successful exploitation grants the attacker the ability to execute arbitrary code or commands on the affected system, potentially leading to full compromise given the high impacts on confidentiality, integrity, availability, and changed scope.
Mitigation details and patches are outlined in the Fortinet PSIRT advisory available at https://fortiguard.fortinet.com/psirt/FG-IR-24-221. Security practitioners should consult this reference for version-specific remediation guidance.
Details
- CWE(s)