CVE-2024-46667
Published: 14 January 2025
Summary
CVE-2024-46667 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Fortinet Fortisiem. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 29.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SC-6 requires mechanisms to protect system resources from unauthorized allocation and consumption, directly addressing the unlimited TLS connection allocation in FortiSIEM.
SC-5 mandates denial-of-service protections that limit the effects of resource exhaustion attacks like connection flooding targeting TLS traffic.
AC-10 limits concurrent sessions or connections, mitigating exhaustion of allotted TLS connections by enforcing usage quotas.
NVD Description
A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to deny valid TLS traffic via consuming all allotted…
more
connections.
Deeper analysisAI
CVE-2024-46667 is a vulnerability involving allocation of resources without limits or throttling, classified under CWE-770, affecting Fortinet FortiSIEM in all versions of 5.3 and 5.4, all 6.x versions, all 7.0 versions, and 7.1.0 through 7.1.5. The issue enables an attacker to consume all allotted connections, resulting in the denial of valid TLS traffic.
With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability can be exploited remotely by unauthenticated attackers requiring low complexity and no user interaction. Exploitation leads to a denial-of-service condition by exhausting connections and blocking legitimate TLS traffic.
Mitigation details are available in the Fortinet PSIRT advisory at https://fortiguard.fortinet.com/psirt/FG-IR-24-164.
Details
- CWE(s)