CVE-2024-55594
Published: 14 March 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2024-55594 involves an improper handling of syntactically invalid structure (CWE-228) in Fortinet FortiWeb, affecting versions 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The vulnerability stems from inadequate processing of malformed structures in HTTP/S requests, enabling attackers to execute unauthorized code or commands.
A remote, unauthenticated attacker (PR:N) can exploit this over the network (AV:N) by sending crafted HTTP/S requests, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Exploitation results in low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L) within the unchanged security scope (S:U), yielding a CVSS v3.1 base score of 5.6.
Fortinet's advisory FG-IR-23-115, available at https://fortiguard.fortinet.com/psirt/FG-IR-23-115, provides details on the vulnerability. Security practitioners should review it for recommended mitigations and patching guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The CVE describes remote unauthenticated code/command execution via crafted HTTP/S requests against a public-facing FortiWeb instance, directly enabling T1190 (Exploit Public-Facing Application).