CVE-2024-26015: fortinet fortios
Vulnerability summary
CVE-2024-26015 is a medium (CVSS 4.7) vulnerability in fortinet fortios. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities.
Timeline
- 09-07-2024PublishedVulnerability first disclosed.
- 01-08-2024Last modifiedVulnerability information updated.
Description
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA3.1LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N/E:F/RL:W/RC:RDiffers
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-1389Incorrect Parsing of Numbers with Different RadicesThe product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a different base number (radix).
- CWE-704Incorrect Type Conversion or CastThe product does not correctly convert an object, resource, or structure from one type to a different type.
Affected systems
Fortinet2 products
- fortios≥ 7.0.0, ≤ 7.0.15 | ≥ 7.2.0, ≤ 7.2.8 | ≥ 7.4.0, ≤ 7.4.3
- fortiproxy≥ 7.4.0, ≤ 7.4.3 | ≥ 7.2.0, ≤ 7.2.10 | ≥ 7.0.0, ≤ 7.0.18 | ≥ 7.0.0, ≤ 7.4.3
1 vendor · 2 products
References
1 links- fortiguard.fortinet.com/psirt/FG-IR-23-446Vendor Advisory