CVE-2024-21754
At a glance Severity LOW 1.7 EPSS EPSS 3.47 % · percentile 89 (2026-10-27) State PUBLISHED Published 2024-06-11 Updated 2025-08-27 Assigner fortinet NVD status Modified Description A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
Scores Version Score Vector Scored by CVSS 3.1 LOW 1.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N/E:F/RL:X/RC:R fortinet CVSS 3.1 LOW 1.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N NVD · psirt@fortinet.com (Secondary) CVSS 3.1 MEDIUM 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.0.14cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.18cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 ≤ 7.2.11cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.3cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 ≤ 6.4.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 ≤ 7.0.15cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.9cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.4Affected products Product Versions Fortinet · FortiProxy affected 7.4.0 ≤ 7.4.2 ; affected 7.2.0 ≤ 7.2.10 ; affected 7.0.0 ≤ 7.0.17 ; affected 2.0.0 ≤ 2.0.14 Fortinet · FortiOS affected 7.4.0 ≤ 7.4.3 ; affected 7.2.0 ≤ 7.2.8 ; affected 7.0.0 ≤ 7.0.15 ; affected 6.4.0 ≤ 6.4.15
References
Sources
