PT-2025-2748 · Fortinet · Fortisase+1

CVE-2024-46669 · Publicado 2025-01-14 · Atualizado 2025-01-15

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.4.4 and below FortiOS versions 7.2.10 and below FortiSASE version 23.4.b

Description: The issue is related to an Integer Overflow or Wraparound vulnerability. This vulnerability may allow an authenticated attacker to crash the IPsec tunnel via crafted requests, resulting in a potential denial of service. The FortiOS tenant IPsec IKE service is affected.

Recommendations: For FortiOS versions 7.4.4 and below, consider disabling the IPsec IKE service until a patch is available. For FortiOS versions 7.2.10 and below, restrict access to the IPsec IKE service to minimize the risk of exploitation. For FortiSASE version 23.4.b, avoid using crafted requests in the IPsec IKE service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2025-04299

CVE-2024-46669

Produtos afetados

Fortios

Fortisase

Referências · 7

• https://twitter.com/CVEnew/status/1879174653756993827 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-46669 · Aviso do Fabricante
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Publicação no Reddit
• https://nvd.nist.gov/vuln/detail/CVE-2024-46669 · Nota de Segurança
• https://fortiguard.fortinet.com/psirt/FG-IR-24-267 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2025-04299 · Nota de Segurança
• https://t.me/cvedetector/15262 · Publicação no Telegram