FG-IR-24-325: Multiple format string vulnerabilities

Q: What is the severity of FG-IR-24-325?

The severity of FG-IR-24-325 is critical due to the potential for unauthorized code execution.

Q: How do I fix FG-IR-24-325?

To mitigate FG-IR-24-325, update to the recommended versions of affected products as specified by Fortinet.

Q: Which products are affected by FG-IR-24-325?

FG-IR-24-325 affects FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiWeb versions prior to their respective remedies.

Q: Who can exploit FG-IR-24-325?

FG-IR-24-325 can be exploited by a privileged attacker through specially crafted HTTP or HTTPS commands.

Q: What kind of vulnerability is FG-IR-24-325?

FG-IR-24-325 is defined as a use of externally-controlled format string vulnerability, classified as CWE-134.

Published Mar 11, 2025

Updated

A use of externally-controlled format string vulnerability [CWE-134] in FortiOS, FortiProxy, FortiPAM, FortiSRA and FortiWeb may allow a privileged attacker to execute unauthorized code or commands via specially crafted HTTP or HTTPS commands.

Affected Software

19 affected componentsFixes available

Fortinet FortiOS>=7.4.0<=7.4.4

Fortinet FortiOS>=7.2.0<=7.2.9

Fortinet FortiOS>=7.0.0<=7.0.15

Fortinet FortiOS>=6.4.0<=6.4.15

Fortinet FortiOS>=6.2.0<=6.2.16

Fortinet FortiPAM>=1.4.0<=1.4.2

Fortinet FortiPAM>=1.3.0<=1.3.1

Fortinet FortiPAM>=1.2

Fortinet FortiPAM>=1.1

Fortinet FortiPAM>=1.0

Fortinet FortiProxy=.

Fortinet FortiProxy>=7.4.0<=7.4.6

Fortinet FortiProxy>=7.2.0<=7.2.12

Fortinet FortiProxy>=7.0.0<=7.0.19

Fortinet FortiSRA>=1.4.0<=1.4.2

Fortinet FortiWeb=.

Fortinet FortiWeb>=7.4.0<=7.4.5

Fortinet FortiWeb>=7.2.0<=7.2.10

Fortinet FortiWeb>=7.0.0<=7.0.10

Event History

Mar 11, 2025

Advisory Published

via FortiGuard·12:00 AM

May 14, 2025

Advisory Published

via FortiGuard·07:55 AM

Frequently Asked Questions

What is the severity of FG-IR-24-325?

The severity of FG-IR-24-325 is critical due to the potential for unauthorized code execution.

How do I fix FG-IR-24-325?

To mitigate FG-IR-24-325, update to the recommended versions of affected products as specified by Fortinet.

Which products are affected by FG-IR-24-325?

FG-IR-24-325 affects FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiWeb versions prior to their respective remedies.

Who can exploit FG-IR-24-325?

FG-IR-24-325 can be exploited by a privileged attacker through specially crafted HTTP or HTTPS commands.

What kind of vulnerability is FG-IR-24-325?