CVE-2021-24006

An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

6.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

0.96% chance of exploitation in the next 30 days, 59th percentile

Published

2021-09-06

Updated

2024-10-25

Proof-of-concept exploits (4)

• cnetsec/CVE-2021-240062★ · 2025-04-08
• cnetsec/CVE-2021-24006-Fortimanager-Exploit1★ · 2025-04-11
• chessredoffsec/CVE-2021-24006
• chessredoffsec/CVE-2021-24006-Fortimanager-Exploit

References

• CVE Record
• NVD entry

Related

• CVE-2021-24019
• CVE-2022-29056
• CVE-2023-26208
• CVE-2023-26209
• CVE-2024-44313
• CVE-2021-23999