CVE-2024-35279
Published: 11 February 2025
Summary
CVE-2024-35279 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Fortinet Fortios. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 16.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SC-7 (Boundary Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the stack-based buffer overflow vulnerability by applying vendor patches to affected FortiOS versions as specified in the advisory.
Minimizes attack surface by prohibiting or restricting the fabric service and CAPWAP on exposed interfaces when not essential.
Enforces boundary protection via firewall rules to block unauthorized crafted UDP packets from reaching the vulnerable CAPWAP control interface.
NVD Description
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker…
more
were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.
Deeper analysisAI
CVE-2024-35279 is a stack-based buffer overflow vulnerability (CWE-121) affecting Fortinet FortiOS versions 7.2.4 through 7.2.8 and 7.4.0 through 7.4.4. The issue resides in the CAPWAP control mechanism and requires the fabric service to be running on an exposed interface. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential high impacts on confidentiality, integrity, and availability.
A remote unauthenticated attacker can exploit this vulnerability by sending crafted UDP packets to the CAPWAP control interface. Successful exploitation allows execution of arbitrary code or commands, provided the attacker evades FortiOS stack protections. The attack vector is network-accessible with high complexity required and no user interaction or privileges needed.
The Fortinet product security incident response team advisory FG-IR-24-160, available at https://fortiguard.fortinet.com/psirt/FG-IR-24-160, details affected versions and recommended mitigations.
Details
- CWE(s)