CVE-2024-35276: Buffer Overflow
First published: Tue Jan 14 2025(Updated: )
A stack-based buffer overflow in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager versions 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, FortiManager Cloud versions 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.11, 6.4.1 through 6.4.7, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3, 7.2.1 through 7.2.5, 7.0.1 through 7.0.11, 6.4.1 through 6.4.7 allows attacker to execute unauthorized code or commands via specially crafted packets.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiAnalyzer | >=7.4.0<=7.4.3>=7.2.0<=7.2.5>=7.0.0<=7.0.12>=6.4.0<=6.4.14 | |
| Fortinet FortiManager | >=7.4.0<=7.4.3>=7.2.0<=7.2.5>=7.0.0<=7.0.12>=6.4.0<=6.4.14 | |
| Fortinet FortiManager Cloud | >=7.4.1<7.4.3>=7.2.1<=7.2.5>=7.0.1<7.0.11>=6.4.1<6.4.7 | |
| Fortinet FortiAnalyzer Cloud | >=7.4.1<7.4.3>=7.2.1<=7.2.5>=7.0.1<7.0.11>=6.4.1<6.4.7 | |
| Fortinet FortiAnalyzer | >=6.4.0<6.4.15 | |
| Fortinet FortiAnalyzer | >=7.0.0<7.0.13 | |
| Fortinet FortiAnalyzer | >=7.2.0<7.2.6 | |
| Fortinet FortiAnalyzer | >=7.4.0<7.4.4 | |
| Fortinet FortiAnalyzer Cloud | >=6.4.1<7.0.12 | |
| Fortinet FortiAnalyzer Cloud | >=7.2.1<7.2.6 | |
| Fortinet FortiAnalyzer Cloud | >=7.4.1<7.4.4 | |
| Fortinet FortiManager | >=6.4.0<6.4.15 | |
| Fortinet FortiManager | >=7.0.0<7.0.13 | |
| Fortinet FortiManager | >=7.2.0<7.2.6 | |
| Fortinet FortiManager | >=7.4.0<7.4.4 | |
| Fortinet FortiManager Cloud | >=6.4.1<7.0.12 | |
| Fortinet FortiManager Cloud | >=7.2.1<7.2.6 | |
| Fortinet FortiManager Cloud | >=7.4.1<7.4.4 |
Remedy
Please upgrade to FortiAnalyzer version 7.6.0 or above Please upgrade to FortiAnalyzer version 7.4.4 or above Please upgrade to FortiAnalyzer version 7.2.6 or above Please upgrade to FortiAnalyzer version 7.0.13 or above Please upgrade to FortiAnalyzer version 6.4.15 or above Please upgrade to FortiManager Cloud version 7.4.4 or above Please upgrade to FortiManager Cloud version 7.2.6 or above Please upgrade to FortiManager Cloud version 7.0.12 or above Please upgrade to FortiAnalyzer Cloud version 7.4.4 or above Please upgrade to FortiAnalyzer Cloud version 7.2.6 or above Please upgrade to FortiAnalyzer Cloud version 7.0.12 or above Please upgrade to FortiPortal version 6.0.16 or above Please upgrade to FortiManager version 7.6.0 or above Please upgrade to FortiManager version 7.4.4 or above Please upgrade to FortiManager version 7.2.6 or above Please upgrade to FortiManager version 7.0.13 or above Please upgrade to FortiManager version 6.4.15 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-35276?
CVE-2024-35276 has a critical severity level due to the potential for remote code execution from a stack-based buffer overflow.
How do I fix CVE-2024-35276?
To mitigate CVE-2024-35276, upgrade Fortinet FortiAnalyzer, FortiManager, and their corresponding cloud services to the latest patched versions.
Which versions are affected by CVE-2024-35276?
CVE-2024-35276 affects multiple versions across FortiAnalyzer and FortiManager, primarily those from 6.4.0 up to 7.4.3.
What products are impacted by CVE-2024-35276?
CVE-2024-35276 impacts Fortinet products including FortiAnalyzer, FortiManager, FortiManager Cloud, and FortiAnalyzer Cloud.
Can exploitation of CVE-2024-35276 lead to data loss?
Yes, successful exploitation of CVE-2024-35276 could potentially lead to data loss as it allows remote code execution.
- agent/remedy
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-api
- source/NVD
- vendor/fortinet
- canonical/fortinet fortianalyzer
- canonical/fortinet fortimanager
- canonical/fortinet fortimanager cloud
- canonical/fortinet fortianalyzer cloud
- version/fortinet fortianalyzer/6.4.0
- version/fortinet fortianalyzer/7.0.0
- version/fortinet fortianalyzer/7.2.0
- version/fortinet fortianalyzer/7.4.0
- version/fortinet fortianalyzer cloud/6.4.1
- version/fortinet fortianalyzer cloud/7.2.1
- version/fortinet fortianalyzer cloud/7.4.1
- version/fortinet fortimanager/6.4.0
- version/fortinet fortimanager/7.0.0
- version/fortinet fortimanager/7.2.0
- version/fortinet fortimanager/7.4.0
- version/fortinet fortimanager cloud/6.4.1
- version/fortinet fortimanager cloud/7.2.1
- version/fortinet fortimanager cloud/7.4.1