CVE-2024-21754
LOW severity · CVSS 1.8 · CWE-916
1.8CVSS LOW
Summary
A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.
Impact & exploitability
Attack vectorLocal
Attack complexityHigh
Privileges requiredHigh
User interactionRequired
Confidentiality impactLow
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)3%
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.