FortiSandbox
CVE-2024-54027: Use of Hard-coded Cryptographic Key in FortiSandbox
A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSandbox 5.0 | 5.0.1 or later |
| FortiSandbox 4.4.0 to 4.4.6 | 4.4.7 or later |
| FortiSandbox 4.2.1 to 4.2.7 | 4.2.8 or later |
| FortiSandbox 4.0.0 to 4.0.5 | 4.0.6 or later |
| FortiSandbox 3.2.0 to 3.2.4 | Upgrade past 3.2.4; see the advisory |
| FortiSandbox 3.1.0 to 3.1.5 | Upgrade past 3.1.5; see the advisory |
| FortiSandbox 3.0.5 to 3.0.7 | Upgrade past 3.0.7; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Use of Hard-coded Cryptographic Key vulnerability [CWE-321] in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access to read sensitive data via CLI.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.