Record status Published
Identifier year (not publication year) 2024
Source publication Mar 11, 2025
Source updated Feb 26, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) A use of externally-controlled format string vulnerability [CWE-134] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, version 7.0.0 through 7.0.15 and before 6.4.15, FortiProxy version 7.4.0 through 7.4.6, version 7.2.0 through 7.2.12 and before 7.0.19, FortiPAM version 1.4.0 through 1.4.2 and before 1.3.1, FortiSRA version 1.4.0 through 1.4.2 and before 1.3.1 and FortiWeb version 7.4.0 through 7.4.5, version 7.2.0 through 7.2.10 and before 7.0.10 allows a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
FortiPAM
Vendor Fortinet
Product FortiPAM
Platforms Unknown
Default status unaffected
FortiPAM · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1.4.0 affectedsemver Unavailable 1.4.2 None listed 1.3.0 affectedsemver Unavailable 1.3.1 None listed 1.2.0 affectedUnavailable Unavailable Unavailable None listed 1.1.0 affectedsemver Unavailable 1.1.2 None listed 1.0.0 affectedsemver Unavailable 1.0.3 None listed
FortiWeb
Vendor Fortinet
Product FortiWeb
Platforms Unknown
Default status unaffected
FortiWeb · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 7.6.0 affectedUnavailable Unavailable Unavailable None listed 7.4.0 affectedsemver Unavailable 7.4.5 None listed 7.2.0 affectedsemver Unavailable 7.2.10 None listed 7.0.0 affectedsemver Unavailable 7.0.10 None listed
FortiProxy
Vendor Fortinet
Product FortiProxy
Platforms Unknown
Default status unaffected
FortiProxy · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 7.6.0 affectedUnavailable Unavailable Unavailable None listed 7.4.0 affectedsemver Unavailable 7.4.6 None listed 7.2.0 affectedsemver Unavailable 7.2.12 None listed 7.0.0 affectedsemver Unavailable 7.0.19 None listed
FortiSRA
Vendor Fortinet
Product FortiSRA
Platforms Unknown
Default status unaffected
FortiSRA · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1.4.0 affectedsemver Unavailable 1.4.2 None listed
FortiOS
Vendor Fortinet
Product FortiOS
Platforms Unknown
Default status unaffected
FortiOS · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 7.4.0 affectedsemver Unavailable 7.4.4 None listed 7.2.0 affectedsemver Unavailable 7.2.9 None listed 7.0.0 affectedsemver Unavailable 7.0.15 None listed 6.4.0 affectedsemver Unavailable 6.4.15 None listed 6.2.0 affectedsemver Unavailable 6.2.16 None listed