PT-2025-2746 · Fortinet · Fortios

Published 2025-01-14 · Updated 2025-07-22 · CVE-2024-46666

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4 through 7.6.0

Description An allocation of resources without limits or throttling vulnerability may allow a remote unauthenticated attacker to prevent access to the GUI via specially crafted requests directed at specific endpoints.

Recommendations FortiOS versions prior to 7.6.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiOS version 7.6.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiOS versions 7.4.0 through 7.4.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiOS version 7.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiOS version 7.0: At the moment, there is no information about a newer version that contains a fix for this vulnerability. FortiOS version 6.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-46666

Affected Products

Fortios

References · 8

• https://fortiguard.fortinet.com/psirt/FG-IR-24-250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46666 · Security Note
• https://osv.dev/vulnerability/CVE-2024-46666 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46666 · Security Note
• https://reddit.com/r/k12cybersecurity/comments/1i1xpbm/msisac_cybersecurity_advisory_multiple · Reddit Post
• https://t.me/cveNotify/129900 · Telegram Post
• https://fortiguard.com/psirt/FG-IR-24-250 · Note
• https://twitter.com/CVEnew/status/1879174627366523008 · Twitter Post