Fortinet FortiOS CVE-2024-48884

Two distinct condition sets apply. The arbitrary-folder-deletion primitive requires only network access to the device's security fabric interface and port with no authentication (PR:N), so any actor able to route to that exposed port can trigger it. The arbitrary-file-write primitive requires a remote attacker to hold authenticated access to the security fabric interface. The dominant limiting factor for both is reachability of the security fabric interface/port: in deployments where the fabric is confined to an isolated management network, external exploitation is not possible, so real-world risk is gated by whether the fabric interface is exposed beyond trusted fabric members rather than by any special non-default product setting.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) rates this 9.1 Critical, and notably PR:N reflects the unauthenticated folder-deletion path rather than the authenticated file-write path - the two attack primitives described carry different real prerequisites, which the single vector blurs. EPSS is high at 39.29% (97th percentile), well above typical, suggesting elevated exploitation interest for an internet-adjacent Fortinet fabric service that historically attracts attackers. However, there is no public exploit identified and no CISA KEV listing at time of analysis, so the EPSS signal is predictive rather than confirmed. The practical risk hinges on exposure of the security fabric interface/port: if that interface is reachable by an attacker, the unauthenticated arbitrary-folder-deletion primitive is a serious availability/integrity threat (potential for disruption or destruction of configuration/data), making this a legitimate priority for internet-facing or improperly segmented Fortinet deployments; if the fabric interface is properly isolated on trusted management networks, real-world reachability is substantially reduced.

An attacker who can reach the exposed security fabric port on a vulnerable FortiOS or FortiProxy device sends a crafted fabric request containing a traversal path (e.g., '../../') to delete an arbitrary folder without any authentication, potentially destroying configuration or operational data and disrupting the device. Alternatively, an attacker holding valid fabric-interface access supplies a traversal path in a file-write operation to plant arbitrary files outside the intended directory. No public proof-of-concept is identified at time of analysis, but the low attack complexity (AC:L) makes reliable exploitation straightforward once the interface is reachable.