CVE-2024-35279: Stack buffer overflow in fabric service
First published: Tue Feb 11 2025(Updated: )
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.
Credit: psirt@fortinet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fortinet FortiOS IPS Engine | >=7.2.4<=7.2.8>=7.4.0<=7.4.4 | |
| Fortinet FortiOS IPS Engine | >=7.4.0<=7.4.4 | |
| Fortinet FortiOS IPS Engine | >=7.2.4<=7.2.8 |
Remedy
Please upgrade to FortiAuthenticator version 7.0.0 or above Please upgrade to FortiOS version 7.6.0 or above Please upgrade to FortiOS version 7.4.5 or above Please upgrade to FortiOS version 7.2.9 or above
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-35279?
CVE-2024-35279 is classified as a critical vulnerability due to its potential to allow remote unauthenticated attackers to execute arbitrary code.
How do I fix CVE-2024-35279?
To fix CVE-2024-35279, upgrade Fortinet FortiOS to versions 7.2.9 or 7.4.5 or later.
What kind of attack does CVE-2024-35279 enable?
CVE-2024-35279 enables remote attackers to exploit a stack-based buffer overflow by sending crafted UDP packets.
Which versions of FortiOS are affected by CVE-2024-35279?
FortiOS versions 7.2.4 through 7.2.8 and 7.4.0 through 7.4.4 are affected by CVE-2024-35279.
Who can exploit CVE-2024-35279?
CVE-2024-35279 can be exploited by remote unauthenticated attackers.
- agent/remedy
- agent/weakness
- agent/type
- collector/fortiguard-psirt-latest
- source/FortiGuard
- alias/CVE-2024-35279
- agent/first-publish-date
- agent/title
- agent/references
- agent/softwarecombine
- agent/description
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/source
- agent/event
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/fortiguard-psirt
- vendor/fortinet
- canonical/fortinet fortios ips engine
- version/fortinet fortios ips engine/7.4.0
- version/fortinet fortios ips engine/7.4.4
- version/fortinet fortios ips engine/7.2.4
- version/fortinet fortios ips engine/7.2.8