CVE-2024-26015

Description

An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests.

CVSS v3.1 Score

3.4

LOW

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness Type (CWE)

CWE-1389 CWE-1389

CWE-704 CWE-704

Affected Products

Vendor	Product	Versions
fortinet	fortiproxy	7.0.0 — 7.4.3
fortinet	fortios	7.0.0 — 7.0.15
fortinet	fortios	7.2.0 — 7.2.8
fortinet	fortios	7.4.0 — 7.4.3

References

Advisories & Patches

https://fortiguard.fortinet.com/psirt/FG-IR-23-446 https://fortiguard.fortinet.com/psirt/FG-IR-23-446

Frequently Asked Questions

What is CVE-2024-26015? +

An incorrect parsing of numbers with different radices vulnerability [CWE-1389] in FortiProxy version 7.4.3 and below, version 7.2.10 and below, version 7.0.17 and below and FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.15 and below IP address validation feature may permit an unauthenticated attacker to bypass the IP blocklist via crafted requests. It has a CVSS v3.1 base score of 3.4 (LOW).

How severe is CVE-2024-26015? +

CVE-2024-26015 has a CVSS v3.1 score of 3.4 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-26015? +

CVE-2024-26015 affects products from fortinet, specifically: fortios, fortiproxy. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-26015? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-50131 8.6

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in …

CVE-2024-6284 7.3

In https://github.com/google/nftables IP addresses were encoded in the wrong byte order, resulting in an nftables configuration which does not work …

CVE-2024-23108 10.0

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to …

CVE-2024-23109 10.0

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to …

CVE-2023-40714 9.9

A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to …

CVE-2023-37936 9.8

A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 and 7.2.0 through 7.2.5 and 7.0.0 through 7.0.7 and …