CVE-2024-32122: 
FortiOS vulnerability analysis and mitigation

A vulnerability (CVE-2024-32122) was discovered in Fortinet FortiOS versions 7.2.0 through 7.2.1, as well as versions 6.4, 7.0, and 7.4, related to storing passwords in a recoverable format. The vulnerability was disclosed on April 8, 2025, and was reported by security researchers Vladislav Driev and Oleg Labyntsev under responsible disclosure (Fortinet PSIRT).

The vulnerability is classified as an insufficiently protected credentials issue (CWE-522) in FortiOS that affects the LDAP authentication mechanism. It received a CVSS v3.1 base score of 2.1 (Low severity) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (NVD).

The vulnerability could lead to information disclosure, specifically allowing an attacker to retrieve LDAP credentials. The impact is considered low severity due to the requirement of privileged authenticated access to exploit the vulnerability (Fortinet PSIRT).

Fortinet has released fixes for the affected versions and recommends users to migrate to a fixed release. FortiOS version 7.6 is not affected by this vulnerability. Users should follow the recommended upgrade path using Fortinet's upgrade tool (Fortinet PSIRT).