CVE-2024-50571
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests.
Risk Assessment
This could lead to compromise of the device and execution of arbitrary commands. It poses a serious threat to the security of network infrastructure.
Recommendation
Update all listed Fortinet products to the latest patched versions as soon as possible. It is also recommended to restrict access to management interfaces.
Other vulnerabilities in FortiAnalyzer
See all- CVE-2025-46773High
An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.
- CVE-2026-84391Medium
A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow an attacker to cause denial of service. The attack vector is not specified.
- CVE-2025-61848High
An SQL injection vulnerability in Fortinet FortiAnalyzer, FortiManager and related products (listed versions) may allow a privileged authenticated attacker to execute unauthorized code or commands via JSON RPC API.
- CVE-2025-54973Medium
A race condition vulnerability in Fortinet FortiAnalyzer allows an attacker to bypass FortiCloud SSO authorization via crafted requests. Affects versions 7.0.0-7.0.13, 7.2.0-7.2.10, 7.4.0-7.4.6, 7.6.0-7.6.2.
Original NVD description (English source)
A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.5, FortiAnalyzer 7.2.0 through 7.2.9, FortiAnalyzer 7.0.0 through 7.0.13, FortiAnalyzer 6.4 all versions, FortiAnalyzer 6.2 all versions, FortiAnalyzer 6.0 all versions, FortiAnalyzer Cloud 7.4.1 through 7.4.5, FortiAnalyzer Cloud 7.2.1 through 7.2.9, FortiAnalyzer Cloud 7.0.1 through 7.0.13, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.9, FortiManager 7.0.0 through 7.0.13, FortiManager 6.4 all versions, FortiManager 6.2 all versions, FortiManager 6.0 all versions, FortiManager Cloud 7.6.2, FortiManager Cloud 7.4.1 through 7.4.5, FortiManager Cloud 7.2.1 through 7.2.9, FortiManager Cloud 7.0.1 through 7.0.13, FortiManager Cloud 6.4 all versions, FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiProxy 7.6.0 through 7.6.1, FortiProxy 7.4.0 through 7.4.7, FortiProxy 7.2.0 through 7.2.12, FortiProxy 7.0.0 through 7.0.19, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS