{"id":"CVE-2024-21754","published":"2024-06-11T14:32:01Z","modified":"2025-08-27T20:42:53Z","title":"A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3…","vendor":"Fortinet","product":"FortiProxy","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiProxy","versions":[">= 7.4.0, <= 7.4.2",">= 7.2.0, <= 7.2.10",">= 7.0.0, <= 7.0.17",">= 2.0.0, <= 2.0.14"]},{"vendor":"Fortinet","product":"FortiOS","versions":[">= 7.4.0, <= 7.4.3",">= 7.2.0, <= 7.2.8",">= 7.0.0, <= 7.0.15",">= 6.4.0, <= 6.4.15"]}],"description":{"text":"A use of password hash with insufficient computational effort vulnerability [CWE-916] affecting FortiOS version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 6.4 all versions and FortiProxy version 7.4.2 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions may allow a privileged attacker with super-admin profile and CLI access to decrypting the backup file.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":1.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N/E:F/RL:X/RC:R","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03469,"percentile":0.89041,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-06-13","exploitedFirstSeen":"2024-06-13","ransomware":false,"evidence":[{"url":"https://cyber.wtf/2024/06/13/give-me-your-fortigate-configuration-backup-and-i-rule-your-network/","date":"2024-06-13"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"ACTUALIZACION | lista de avisos para problemas resueltos en los productos Fortinet.","url":"https://otx.alienvault.com/pulse/667076cf431370db792c6b9a","created":"2024-06-17"},{"name":"ACTUALIZACION | lista de avisos para problemas resueltos en los productos Fortinet.","url":"https://otx.alienvault.com/pulse/667076cb8b848acc6930a628","created":"2024-06-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-916","name":"Use of Password Hash With Insufficient Computational Effort"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-23-423","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19368","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19368","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-06-27","earliestUrl":"https://github.com/CyberSecuritist/CVE-2024-21754-Forti-RCE","repos":[{"name":"CyberSecuritist/CVE-2024-21754-Forti-RCE","url":"https://github.com/CyberSecuritist/CVE-2024-21754-Forti-RCE","stars":2,"created":"2024-06-27"}]},"first":{"date":"2024-06-27","source":"PoC-in-GitHub","url":"https://github.com/CyberSecuritist/CVE-2024-21754-Forti-RCE"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-06-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-21754","provenance":"source"},{"date":"2024-06-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyber.wtf/2024/06/13/give-me-your-fortigate-configuration-backup-and-i-rule-your-network/","provenance":"source"},{"date":"2024-06-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CyberSecuritist/CVE-2024-21754-Forti-RCE","provenance":"source"}],"speed":{"daysToPublicExploit":16,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":60.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 869 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.81,"detail":"percentile 0.8904"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":1.19,"detail":"base score 1.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}