Fortinet FortiWeb
CVE-2024-48885
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Fortinet appliance service
-
DeliverySend specially crafted packets
-
ExploitTraverse outside restricted directory
-
ExecutionWrite to privileged path
-
PersistEscalate privileges on appliance
-
ImpactCompromise integrity and availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the vulnerable Fortinet service that processes the 'specially crafted packets' referenced in the advisory, on an affected FortiWeb (6.4/7.0/7.2/7.4.0-7.4.4/7.6.0), FortiVoice (6.0/6.4.0-6.4.9/7.0.0-7.0.4), or FortiRecorder (7.0.0-7.0.4/7.2.0-7.2.1) build. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required against a reachable instance; the primary limiting factor is exposure - appliances whose affected service is confined to a trusted management network are not reachable by external attackers. Note the ambiguity: the outcome is described as privilege escalation while the vector states PR:N, so defenders should confirm with FG-IR-24-259 whether any prior access is actually needed. |
| Impact | The signals are mixed. CVSS 3.1 is 9.1 (Critical) with AV:N/AC:L/PR:N/UI:N, implying trivial remote unauthenticated exploitation, yet the description frames the outcome as 'escalate privilege,' language that usually implies the attacker already holds some foothold - this is a genuine tension between the vector (PR:N) and the wording that defenders should verify against FG-IR-24-259. Counterbalancing the high CVSS, EPSS is only 0.39% (60th percentile), the CVE is not on CISA KEV, and no public POC has been identified, so there is no evidence of active or imminent mass exploitation. No SSVC decision data was provided. Net assessment: a legitimately high-severity flaw on internet-facing security/UC appliances that warrants prompt patching, but current real-world exploitation risk appears low-to-moderate and likely targeted rather than opportunistic; prioritize by exposure of the management interface. |
| Exploit ScenarioDerived | An attacker with network reachability to an exposed FortiWeb, FortiVoice, or FortiRecorder service sends specially crafted packets containing traversal sequences that escape the restricted directory, allowing them to write to or manipulate privileged paths and escalate to elevated privileges on the appliance. Given AV:N/AC:L, no user interaction or complex conditions are required once the service is reachable; however, no public POC has been identified, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jul 08, 2026
Privilege escalation via path traversal affects multiple Fortinet appliances - FortiWeb (6.4, 7.0, 7.2, 7.4.0-7.4.4, 7.6.0), FortiVoice (6.0, 6.4.0-6.4.9, 7.0.0-7.0.4), and FortiRecorder (7.0.0-7.0.4, 7.2.0-7.2.1) - where an attacker sends specially crafted packets that break out of a restricted directory to gain elevated privileges. Fortinet PSIRT scores this CVSS 9.1 with no confidentiality impact but high integrity and availability impact, reflecting a management-plane compromise rather than data theft. There is no public exploit identified at time of analysis and EPSS is modest (0.39%, 60th percentile), so exploitation is not yet observed at scale.
Earlier versions of this analysis (2)
Privilege escalation in multiple Fortinet appliances - FortiWeb (6.4 through 7.6.0), FortiVoice (6.0 through 7.0.4), and FortiRecorder (7.0.0 through 7.2.1) - lets a remote attacker abuse a path-traversal flaw (CWE-22) via specially crafted packets to gain elevated privileges. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N) reflecting high integrity and availability impact with no confidentiality loss. No public exploit identified at time of analysis, and EPSS is modest at 0.39% (60th percentile); the flaw is not listed in CISA KEV.
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. No vendor patch available.
RemediationAI
Upgrade each affected product to a Fortinet-fixed release as specified in advisory FG-IR-24-259 (https://fortiguard.fortinet.com/psirt/FG-IR-24-259); exact fixed build numbers should be taken directly from that advisory as they were not included in this dataset. Patch available per vendor advisory - apply the vendor-released fixed versions for your specific FortiWeb, FortiVoice, or FortiRecorder branch. Until patched, restrict network reachability of the appliance management and service interfaces: limit administrative and service access to trusted management networks or VPN, place the appliances behind firewall rules that block untrusted sources from the affected service ports, and disable or restrict any externally exposed management access - noting the trade-off that tightening management access may disrupt remote administration and legitimate integrations, so validate allowlists before enforcing.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-22 (improper limitation of a pathname to a restricted directory, i.e. path traversal), in which user-controllable input embedded in network packets is used to construct a filesystem path without sufficient canonicalization or sandbox enforcement, letting an attacker reference locations outside the intended directory. The affected components are Fortinet's appliance operating environments across three product lines (FortiWeb web application firewall, FortiVoice unified communications, FortiRecorder network video recorder), all sharing common Fortinet platform code, which explains why a single flaw spans all three. The CVSS vector (C:N/I:H/A:H) indicates the traversal is leveraged not to read files but to write to or manipulate privileged paths, resulting in privilege escalation and integrity/availability compromise of the appliance.
Know when Fortirecorder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Network-reachable service parses crafted packets with low complexity and per vendor no prior auth (PR:N); traversal enables privileged writes so I:H/A:H, with no data disclosure (C:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0 all versions, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to escalate privilege via specially crafted packets.
Executive ViewAI
Fortinet security appliances (FortiWeb, FortiVoice, FortiRecorder) contain a critical privilege escalation vulnerability (CVSS 9.1) that allows attackers to bypass access controls and compromise management functions through specially crafted network packets. With no vendor patch currently available, any organization operating these appliances faces exposure to attackers who could disable security policies, modify configurations, or lock out legitimate administrators. The modest exploitation probability (EPSS 0.4%) provides a limited window to implement interim protections before this vulnerability attracts wider adversary attention.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict management interface access to trusted internal networks and disable external access; (2) Disable unused services and protocols on affected appliances; (3) Enforce additional authentication controls including administrative credential rotation; (4) Enable detailed logging of all management-plane activity and configure real-time alerting for unauthorized access attempts; (5) Implement out-of-band management channels (console, serial) where feasible to reduce network-based attack surface; (6) Prepare incident response plan for rapid detection and containment should management-plane compromise be suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)NVD
More in Fortirecorder
View allArbitrary file write and folder deletion in Fortinet FortiManager, FortiOS, and FortiProxy is possible via a path traver
An exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE-497] in FortiDDoS versi
A externally controlled reference to a resource in another sphere vulnerability in Fortinet allows attacker to poison we
A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7
Multiple relative path traversal vulnerabilities [CWE-23] vulnerability in Fortinet FortiCamera 2.1 all versions, FortiC
Fortinet FortiCamera, FortiMail, FortiNDR, FortiRecorder, and FortiVoice contain a stack-based buffer overflow enabling
An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail vers
A improper limitation of a pathname to a restricted directory ('path traversal') [CWE-23] in Fortinet FortiRecorder vers
A relative path traversal in Fortinet FortiRecorder [CWE-23] version 7.2.0 through 7.2.1 and before 7.0.4 allows a privi
GitHub PoC
Exploit-DB