CVE-2024-23104

CVE-2024-23104 is an information disclosure vulnerability affecting multiple Fortinet products, including FortiNDR versions 7.0 through 7.6.0 and FortiVoice versions 7.0.0 through 7.0.1. A remote authenticated attacker with at least read-only system maintenance permissions can exploit this vulnerability by submitting specially crafted HTTP requests to access sensitive backup information that should not be accessible to their privilege level. The vulnerability carries a CVSS v3.1 score of 4.3 (Medium severity) with a network attack vector, low complexity, and low privilege requirements. The attack requires user interaction to be minimal, as attackers need only valid read-only credentials and network access to the affected system. While the confidentiality impact is limited, the vulnerability could expose sensitive backup data and system configuration information. There is no current evidence of active exploitation in the wild, as the vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and is classified as inactive on threat tracking lists. The extremely low EPSS score of 0.00029 indicates minimal real-world exploitation probability. Organizations using affected Fortinet products should apply available patches but may prioritize this remediation below more critically exploited vulnerabilities.