{"id":"CVE-2024-50568","aliases":["EUVD-2025-17798","GHSA-q6xx-gv82-hc4m"],"status":"published","title":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0...","description":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:X/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00466,"percentile":0.40754,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-300"],"published":"2025-06-10T16:36:21Z","modified":"2026-06-17T08:04:42Z","products":[{"vendor":"fortinet","product":"fortios"},{"vendor":"fortinet","product":"fortiproxy"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-058","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-50568"},{"url":"https://github.com/advisories/GHSA-q6xx-gv82-hc4m"}],"sources":{"cve":[{"id":"CVE-2024-50568","description":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.","status":"published","published":"2025-06-10T16:36:21.786Z","modified":"2025-06-10T18:49:54.977Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:X/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-300"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2025-17798","description":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.","status":"published","published":"2025-06-10T16:36:21Z","modified":"2025-06-10T18:49:54Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:X/RC:C","level":"medium"}],"updated_at":"2026-11-02T20:32:26.351797Z"}],"ghsa":[{"id":"GHSA-q6xx-gv82-hc4m","title":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0...","description":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.","status":"published","published":"2025-06-10T18:32:27Z","modified":"2025-06-10T18:32:30Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-300"],"updated_at":"2026-11-02T15:02:39.469785Z"}],"nvd":[{"id":"CVE-2024-50568","description":"A channel accessible by non-endpoint vulnerability [CWE-300] in Fortinet FortiOS version 7.4.0 through 7.4.3, 7.2.0 through 7.2.7 and before 7.0.14 \u0026 FortiProxy version 7.4.0 through 7.4.3, 7.2.0 through 7.2.9 and before 7.0.16 allows an unauthenticated attacker with the knowledge of device specific data to spoof the identity of a downstream device of the security fabric via crafted TCP requests.","status":"published","published":"2025-06-10T17:19:25.66Z","modified":"2026-06-17T08:04:42.96Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-300"],"updated_at":"2026-11-02T14:10:47.073504Z"}]}}