External risk intelligence

FortiManager FortiOS FortiProxy Path Traversal Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-48884

The affected products include network gateways, proxies, and management appliances such as FortiManager, FortiOS, and FortiWeb. These devices are commonly deployed at the network edge or as internet-facing management services, making the security fabric interface and associated management surfaces inherently reachable in typical enterprise network deployments.

Path Traversal

Fortinet Fortimanager

7.4.1 to before 7.4.47.6.0 to before 7.6.21.0.0 to before 7.0.197.2.0 to before 7.2.127.4.0 to before 7.4.67.0.0 to before 7.0.57.2.0 to before 7.2.26.0.0 to 6.4.107.0.0 to 7.0.56...

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Fortinet products could allow unauthorized attackers to write arbitrary files or delete folders. This issue affects multiple Fortinet management, operating system, and proxy devices. The primary concern is to confirm if these specific products and versions are in use and exposed to the internet or internal networks.

Unauthorized file manipulation is possible.
Affects critical network infrastructure products.
Verify product usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging an exposed security fabric interface on network devices. This allows for unauthorized file manipulation or deletion. The attack could lead to significant system compromise.

Network exposure required.
Path traversal to overwrite files.
Arbitrary file write/folder delete risk.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability could allow attackers to write arbitrary files to systems or delete arbitrary folders. This could occur when supported security fabric interfaces are accessible.

System configuration files at risk.
Unauthenticated or authenticated access.
Potential for system disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability impacts Fortinet's network management, firewall, and proxy devices, potentially allowing unauthenticated attackers to delete folders and authenticated attackers to write arbitrary files. Ownership of the remediation effort likely falls to the teams managing these Fortinet appliances, which could include infrastructure, network, or security operations teams. The immediate first step is to inventory all deployed Fortinet devices, identify those with exposed management interfaces, and confirm business criticality.

Identify and inventory all affected devices.
Verify exposure and business criticality.
Plan and coordinate remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Fortinet software affected by CVE-2024-48884?

This vulnerability affects a broad range of Fortinet infrastructure technology, including FortiManager for centralized management, FortiOS for firewall and networking, and FortiProxy for traffic filtering. It also extends to specialized appliances like FortiWeb, FortiVoice, and FortiRecorder. These components function as the backbone for network security and traffic control within enterprise environments, often managing configurations, security policies, and data flow across the network.

What does path traversal mean in the context of this vulnerability?

Path traversal, identified as CWE-22, is a weakness where software does not properly filter input used to access file paths. Instead of being restricted to intended directories, an attacker can use special characters to navigate outside those bounds. In CVE-2024-48884, this flaw is critical because it grants unauthorized control over the file system, enabling attackers to delete arbitrary folders or, under certain conditions, write arbitrary files to the device.

How can an attacker trigger this vulnerability?

The attack depends on reaching the security fabric interface of the affected device. While an authenticated attacker with access can write files, an unauthenticated attacker can delete arbitrary folders. Simply having the device on the network is not enough; the attack requires the specific security fabric port or interface to be accessible. Interactions that do not touch this specific interface or fall outside the identified network paths do not trigger this flaw.

Is my organization at risk from CVE-2024-48884?

Halo Surface Signal indicates that because affected products like FortiManager and FortiOS are frequently deployed as network gateways or management appliances, they are often placed at the network edge. If your organization has these interfaces exposed to the internet, your risk profile is higher. Organizations using these versions should prioritize identifying which instances are internet-facing versus those restricted to internal, segmented management networks.

What are the first steps to address this threat?

Start by conducting a comprehensive inventory of all Fortinet appliances in your environment to identify versions matching those in the affected list. Once identified, evaluate the network accessibility of the management and security fabric interfaces on these devices. Prioritize patching or configuration changes for any systems that are internet-facing, as these represent the most immediate points of concern for potential unauthorized access.

References

fortiguard.fortinet.com/psirt/FG-IR-24-259

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.