FG-IR-24-160: Stack buffer overflow in fabric service
Published Feb 11, 2025
·Updated
A stack-based buffer overflow [CWE-121] vulnerability in FortiOS CAPWAP control may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.
Affected Software
2 affected componentsFixes available
Fortinet FortiOS>=7.4.0<=7.4.4
Fortinet FortiOS>=7.2.4<=7.2.8
Event History
Feb 11, 2025
Advisory Published
via FortiGuard·12:00 AM
Data Sourced
via FortiGuard·12:00 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of FG-IR-24-160?
The severity of FG-IR-24-160 is considered high due to its potential for remote code execution.
2
How do I fix FG-IR-24-160?
To fix FG-IR-24-160, upgrade FortiOS to version 7.4.5 or 7.2.9 or later.
3
What systems are affected by FG-IR-24-160?
FG-IR-24-160 affects FortiOS versions from 7.4.0 to 7.4.4 and from 7.2.4 to 7.2.8.
4
Can FG-IR-24-160 be exploited without authentication?
Yes, FG-IR-24-160 can be exploited by remote unauthenticated attackers.
5
What type of vulnerability is FG-IR-24-160?
FG-IR-24-160 is classified as a stack-based buffer overflow vulnerability.