Introduction
A heap-based buffer overflow in the fgfmsd daemon may let an attacker who holds Fortinet management credentials execute unauthorized code on core security infrastructure. The flaw affects a wide range of Fortinet products that enterprises use for centralized management and analytics, including FortiAnalyzer, FortiManager, FortiOS, and FortiProxy. Organizations that rely on these platforms for security operations and compliance have significant exposure.
Fortinet is a leading global cybersecurity vendor with hundreds of thousands of enterprise customers. Its portfolio includes next-generation firewalls, centralized management, analytics, and secure web gateway products. Its management and analytics platforms are widely deployed in critical infrastructure, financial services, healthcare, and government networks, so flaws in these products concern the wider tech industry.
Technical information
CVE-2024-50571 is a heap-based buffer overflow in fgfmsd, the daemon that handles FortiGate to FortiManager protocol (FGFM) communications. It is classified as CWE-122 (Heap-based Buffer Overflow), and Fortinet tracks it as FG-IR-24-442. An authenticated attacker triggers the flaw by sending a specially crafted request to the fgfmsd service. Improper validation or missing bounds checks let data be written past the allocated heap buffer, which corrupts memory. That can lead to arbitrary code execution in the context of the fgfmsd process, and potentially to attacker control of the affected system.
Exploitation requires authentication, so the attacker needs valid credentials or a way to compromise them. No public code snippets or proof-of-concept exploits are available for this vulnerability. The vulnerable code appears in several major version branches, which indicates it has been in the codebase for a long time.
Affected systems and versions
CVE-2024-50571 affects the following Fortinet products and versions:
- FortiAnalyzer: 7.6.0 through 7.6.2, 7.4.0 through 7.4.5, 7.2.0 through 7.2.8, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15, 6.2.0 through 6.2.13, 6.0.0 through 6.0.12
- FortiManager: 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9, 7.0.0 through 7.0.13, 6.4.0 through 6.4.15, 6.2.0 through 6.2.13, 6.0.0 through 6.0.12
- FortiOS: 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, 6.4.0 through 6.4.15, 6.2.0 through 6.2.17
- FortiProxy: 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.12, 7.0.0 through 7.0.19, 2.0.0 through 2.0.14, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7
- FortiManager Cloud: 7.6.2, 7.4.1 through 7.4.5, 7.2.1 through 7.2.8, 7.0.1 through 7.0.13, 6.4.1 through 6.4.7
- FortiAnalyzer Cloud: 7.4.1 through 7.4.5, 7.2.1 through 7.2.8, 7.0.1 through 7.0.13, 6.4.1 through 6.4.7
Both on-premises and cloud deployments running these versions are affected.
Vendor security history
Fortinet has fixed earlier vulnerabilities in its management and protocol daemons, including:
- CVE-2024-47575: Missing authentication in the fgfmd daemon of FortiManager, which was exploited in the wild.
- CVE-2021-32589: Use-after-free in fgfmsd affecting FortiManager and FortiAnalyzer.
Fortinet's PSIRT generally publishes coordinated advisories and patches. Still, repeated flaws in core management components point to ongoing difficulty with secure development in complex infrastructure products.
