CVE-2024-26010: 
FortiOS vulnerability analysis and mitigation

A stack-based buffer overflow vulnerability (CVE-2024-26010) was discovered in multiple Fortinet products including FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager. The vulnerability was internally discovered by Gwendal Guégniaud of Fortinet Product Security team and was disclosed on June 11, 2024. The affected products include multiple versions of FortiOS (6.0.x through 7.4.3), FortiProxy (1.0.x through 7.4.3), FortiPAM (1.0.x through 1.2.0), and FortiSwitchManager (7.0.1 through 7.2.3) (Fortinet Advisory).

The vulnerability is classified as a stack-based buffer overflow (CWE-121) in the fgfmd daemon. It received a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw can be triggered via specially crafted packets reaching the fgfmd daemon, under certain conditions which are outside the control of the attacker (Fortinet Advisory, NVD).

If successfully exploited, this vulnerability allows remote attackers to execute unauthorized code or commands on affected systems. The potential impact includes complete compromise of system confidentiality, integrity, and availability on the affected devices (Fortinet Advisory).

Fortinet has released patches for all affected products and recommends upgrading to the fixed versions: FortiOS 7.4.4, 7.2.8, or 7.0.15; FortiProxy 7.4.4, 7.2.10, or 7.0.17; and FortiSwitchManager 7.2.4 or 7.0.4. A temporary workaround involves removing fgfm access for each interface. Additionally, implementing a local-in policy that restricts FGFM connections to specific IPs can reduce the attack surface, though this should be considered a partial mitigation rather than a complete solution (Fortinet Advisory).