External risk intelligence

Fortinet FortiRecorder FortiVoice FortiWeb Path Traversal Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-48885

The affected products include FortiWeb, which is commonly deployed as an internet-facing web application firewall or edge gateway, and FortiVoice/FortiRecorder, which are often networked appliances. These products frequently serve as edge services or gateways, making them reachable from the internet in many standard enterprise deployments.

Path Traversal

Fortinet Fortirecorder

7.0.0 to before 7.0.57.2.0 to before 7.2.26.0.0 to 6.4.107.0.0 to 7.0.56.4.0 to before 7.4.57.6.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Fortinet's FortiRecorder, FortiVoice, and FortiWeb products, stemming from an improper limitation of file paths that could allow an attacker to escalate privileges. This issue is particularly concerning due to the nature of these products, which often function as network-facing appliances or security gateways. While the exact business impact requires further investigation into specific deployments, the potential for unauthorized privilege escalation warrants attention.

Attackers can exploit path traversal to gain elevated access.
Edge devices and gateways are often affected.
Confirm relevance and exposure to understand impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted packets to an exposed Fortinet device. This could allow them to bypass security restrictions and gain elevated privileges on the affected system.

No authentication required.
Path traversal via crafted packets.
Privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability could allow an attacker to escalate privileges on Fortinet devices. This could occur when the system is subject to specially crafted network packets, potentially impacting the integrity and availability of the device's services.

Device privilege escalation.
Specially crafted network packets.
Unauthorized system access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The identified vulnerability in Fortinet products (FortiRecorder, FortiVoice, and FortiWeb) likely impacts teams responsible for network security, application delivery, and infrastructure management. The initial step should be to identify all instances of the affected technology, assess their exposure and criticality, and confirm the accountable owner for remediation planning.

Network and security teams own this issue.
Verify product exposure and criticality first.
Plan vendor coordination and upgrade.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are FortiRecorder, FortiVoice, and FortiWeb used for?

These Fortinet products serve as critical infrastructure appliances. FortiWeb acts as a web application firewall to protect online services, while FortiRecorder and FortiVoice are systems designed for call recording and enterprise telephony management. Because they manage network traffic and communications, they are often positioned at the edge of a corporate network to handle external data flows.

What does path traversal mean in CVE-2024-48885?

This vulnerability is classified as CWE-22, or improper limitation of a pathname. In simple terms, it means the software fails to properly check file paths in incoming data. An attacker can use this weakness to trick the system into accessing or modifying files outside of the intended, restricted directory, ultimately leading to unauthorized privilege escalation.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending specially crafted network packets to the targeted Fortinet device. Because the flaw exists in how the system processes these packets, it does not require the attacker to have valid login credentials or prior access. Note that simply interacting with the device's standard, non-malicious features will not trigger this bug; it requires specifically designed packets intended to bypass security controls.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that these products are often deployed as internet-facing gateways or edge services. Because they are designed to be reachable from the internet, they have a higher likelihood of being exposed to remote attacks compared to internal-only systems. You should prioritize checking any instance of FortiWeb, FortiRecorder, or FortiVoice that is directly connected to the internet.

What should I do if I run these Fortinet products?

Start by identifying every instance of these products within your environment to determine which versions are currently active. Once you have a complete list, assess the exposure of each device to the internet and confirm who is responsible for managing them. Coordinate with your team to review the official vendor guidance and plan the necessary software updates to secure your systems.

References

fortiguard.fortinet.com/psirt/FG-IR-24-259

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.