CVE-2024-26015
published 2024-07-09CVE-2024-26015: An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17…
PriorityP425medium4.7CVSS 3.1
AVAACLPRNUINSCCNILAN
EPSS
0.47%
39.6th percentile
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortios | — | — |
| fortinet | fortios | 7.0.0 – 7.0.15 | — |
| fortinet | fortios | 7.2.0 – 7.2.8 | — |
| fortinet | fortios | 7.4.0 – 7.4.3 | — |
| fortinet | fortiproxy | — | — |
| fortinet | fortiproxy | 7.0.0 – 7.4.3 | — |
| fortinet | fortiproxy | 7.2.0 – 7.2.10 | — |
| fortinet | fortiproxy | 7.4.0 – 7.4.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
FortiOS - IP address validation mishandles zero characters
vendor_fortinet·2024-07-09·CVSS 3.4
CVE-2024-26015 [LOW] CWE-1389 FortiOS - IP address validation mishandles zero characters
FG-IR-23-446: FortiOS - IP address validation mishandles zero characters
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.
CVEs: CVE-2024-26015
CWEs: CWE-1389, CWE-704
CVSS: 3.4 (low)
Affected products: FortiOS, FortiProxy
GHSA
GHSA-28x5-qjqx-j9fr: An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7
ghsa_unreviewed·2024-07-09
CVE-2024-26015 [LOW] CWE-1389 GHSA-28x5-qjqx-j9fr: An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7
An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-09
Published