CVE-2024-50562

MEDIUM EPSS 60.8%

Published Jun 10, 20251y ago · Modified Jun 17, 20262w ago

4.8 CVSS 3.1

Medium

Published Jun 10, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

An Insufficient Session Expiration vulnerability [CWE-613] in FortiOS SSL-VPN version 7.6.0, version 7.4.6 and below, version 7.2.10 and below, 7.0 all versions, 6.4 all versions may allow an attacker in possession of a cookie used to log in the SSL-VPN portal to log in again, although the session has expired or was logged out.

CVSS Details

Base Score

4.8

Exploitability

2.2

Impact

2.5

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity Low

Availability None

Threat Intelligence

EPSS Exploit Probability

60.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-613

Affected Products 4

Vendor	Product	Version	Range
fortinet	fortisase	24.4.60	any
fortinet	fortios	*	≥6.4.0 – <7.2.11
fortinet	fortios	*	≥7.4.0 – <7.4.8
fortinet	fortios	7.6.0	any

References 2

cert-portal.siemens.com https://cert-portal.siemens.com/productcert/html/ssa-864900.html
fortiguard.fortinet.com https://fortiguard.fortinet.com/psirt/FG-IR-24-339

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.