How severe is CVE-2024-40591?

CVE-2024-40591 has a CVSS v3 score of 8.8 (HIGH).

CVE-2024-40591

Name: fortios
Author: fortinet

8.8HIGH

An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profi

Published: 2/11/2025Updated: 7/17/2025

Description

An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.

AI AnalysisPowered by AI

Affected Products

fortinetfortios

7.6.0

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-302
Vendor Advisory