CVE-2024-46668
Published: 14 January 2025
Description
An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions 7.0.0 through 7.0.15, and versions 6.4.0 through 6.4.15 may allow an unauthenticated remote user to consume all system memory via multiple large file uploads.
Security Summary
CVE-2024-46668 is an allocation of resources without limits or throttling vulnerability (CWE-770) affecting FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, and 6.4.0 through 6.4.15. It enables an unauthenticated remote user to exhaust system memory through multiple large file uploads, earning a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
An unauthenticated attacker with network access can exploit this flaw by sending numerous oversized files to the affected FortiOS instances, leading to complete memory consumption and potential denial-of-service conditions that disrupt device functionality.
Fortinet's advisory FG-IR-24-219 provides details on the vulnerability, affected versions, and recommended mitigation steps, including upgrading to patched releases outside the vulnerable ranges.
Details
- CWE(s)