FG-IR-24-098: Stack buffer overflow in CLI command
Published Nov 12, 2024
·Updated
A stack-based buffer overflow vulnerability [CWE-121] in FortiManager, FortiAnalyzer and FortiAnalyzer-BigData CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.
Affected Software
15 affected componentsFixes available
Fortinet FortiAnalyzer>=7.4.0<=7.4.2
Fortinet FortiAnalyzer>=7.2.0<=7.2.5
Fortinet FortiAnalyzer>=7.0
Fortinet FortiAnalyzer>=6.4
Fortinet FortiAnalyzer>=6.2
Fortinet FortiAnalyzer-BigData=.
Fortinet FortiAnalyzer-BigData=.
Fortinet FortiAnalyzer-BigData>=7.0
Fortinet FortiAnalyzer-BigData>=6.4
Fortinet FortiAnalyzer-BigData>=6.2
Fortinet FortiManager>=7.4.0<=7.4.2
Fortinet FortiManager>=7.2.0<=7.2.5
Fortinet FortiManager>=7.0
Fortinet FortiManager>=6.4
Fortinet FortiManager>=6.2
Event History
Nov 12, 2024
Advisory Published
via FortiGuard·12:00 AM
Frequently Asked Questions
1
What is the severity of FG-IR-24-098?
The severity of FG-IR-24-098 is critical due to its potential to allow privileged attackers to execute unauthorized code.
2
How do I fix FG-IR-24-098?
To fix FG-IR-24-098, upgrade your FortiManager or FortiAnalyzer to the recommended versions as specified in the advisory.
3
Which versions of FortiManager are affected by FG-IR-24-098?
FG-IR-24-098 affects FortiManager versions prior to 7.2.6 and 7.4.3.
4
Which versions of FortiAnalyzer are vulnerable to FG-IR-24-098?
FG-IR-24-098 impacts FortiAnalyzer versions prior to 7.2.6 and 7.4.3.
5
Can FG-IR-24-098 lead to remote code execution?
Yes, FG-IR-24-098 can lead to remote code execution if exploited by a privileged attacker.