---
id: CVE-2024-32122
title: >-
  A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through
  7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all
  versions allows attacker to information disclosure via modification of LDAP
  server I…
summary: >-
  A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through
  7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all
  versions allows attacker to information disclosure via modification of LDAP
  server I…
severity: low
cvss: 2.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C'
cvssSource: cna
cwe:
  - CWE-257
vendor: Fortinet
product: FortiOS
affected:
  - FortiOS >= 7.4.0 <= 7.4.8
  - FortiOS >= 7.2.0 <= 7.2.12
  - FortiOS >= 7.0.0 <= 7.0.18
  - FortiOS >= 6.4.0 <= 6.4.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-04-08T14:31:46.040059Z'
published: '2025-04-08'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T00:40:34.693Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-32122'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-111'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-111'
tags:
  - cve.org
epss: 0.00218
epssPercentile: 0.12176
ingestedAt: '2026-10-15T04:46:37.312Z'
---

## Overview

A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions allows attacker to information disclosure via modification of LDAP server IP to point to a malicious server.

## Affected

- `FortiOS >= 7.4.0 <= 7.4.8`
- `FortiOS >= 7.2.0 <= 7.2.12`
- `FortiOS >= 7.0.0 <= 7.0.18`
- `FortiOS >= 6.4.0 <= 6.4.16`

## Remediation

Upgrade to FortiOS version 7.6.0 or above
Upgrade to FortiOS version 7.4.9 or above