Denial of Service Vulnerability Affecting Fortinet FortiOS
A vulnerability affecting the Fortinet FortiOS operating system has been identified. It allows a remote user to exhaust management web service resources and trigger a denial of service (DoS) on the administrative graphical user interface (GUI).
Description
Technical context and vulnerability details
The Fortinet FortiOS web administration graphical interface (GUI) provides firewall rule configuration, bandwidth monitoring, and daily operations for FortiGate network security appliances.
These products are affected by the following vulnerabilities:
CVE-2024-46666: Uncontrolled resource consumption vulnerability during heavy request processing (CWE-770). A remote attacker can send abnormal requests resulting in an unexpected termination of the HTTP/HTTPS management service. Classified High with a CVSS v3.1 base score of 7.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Prolonged loss of access to the web administration interface (GUI);
- Temporary inability to adjust or audit security policies in real time;
- Targeted impact on the availability of administrative functionalities.
Affected systems
Products, components and targeted versions
- FortiOS 7.6: version 7.6.0;
- FortiOS 7.4: versions 7.4.0 to 7.4.4;
- FortiOS 7.2: all versions;
- FortiOS 7.0: all versions;
- FortiOS 6.4: all versions.
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Upgrade FortiOS 7.6 to version 7.6.1 or later;
- Upgrade FortiOS 7.4 to version 7.4.5 or later;
- Migrate appliances on FortiOS 7.2, 7.0, or 6.4 to an actively supported release;
- Restrict administrative access to authorized IP address ranges via Local-In Policies.
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.