CVE-2024-23663: Fortinet FortiExtender Privilege Escalation

CVE-2024-23663 Overview

CVE-2024-23663 is an improper access control vulnerability [CWE-284] affecting Fortinet FortiExtender across multiple firmware branches. An authenticated attacker can send a crafted HTTP request to create users with elevated privileges. The flaw affects FortiExtender versions 4.1.1 through 4.1.9, 4.2.0 through 4.2.6, 5.3.2, 7.0.0 through 7.0.4, 7.2.0 through 7.2.4, and 7.4.0 through 7.4.2.

Successful exploitation grants an attacker administrative control over the FortiExtender device, compromising confidentiality, integrity, and availability of the managed cellular gateway.

Critical Impact
An authenticated attacker can escalate privileges to administrator by creating new users with elevated roles through the management interface.

Affected Products

Fortinet FortiExtender firmware versions 4.1.1 – 4.1.9, 4.2.0 – 4.2.6, and 5.3.2
Fortinet FortiExtender firmware versions 7.0.0 – 7.0.4 and 7.2.0 – 7.2.4
Fortinet FortiExtender firmware versions 7.4.0 – 7.4.2

Discovery Timeline

2024-07-09 - CVE-2024-23663 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23663

Vulnerability Analysis

The vulnerability resides in the FortiExtender management interface. Fortinet's implementation fails to properly enforce access control checks on user-creation requests. An authenticated low-privileged user can submit a crafted HTTP request to the administrative endpoint responsible for account provisioning. The endpoint accepts privilege parameters supplied by the caller without verifying whether the requester holds sufficient rights to grant them.

This authorization gap enables vertical privilege escalation. An attacker with any valid session can create a new account with administrator-level permissions and then re-authenticate as that account to gain full device control. Because FortiExtender devices act as cellular WAN gateways, a compromised device exposes traffic transiting the appliance and provides a foothold for lateral movement into connected networks.

Root Cause

The root cause is missing server-side authorization enforcement on the user management API. The application relies on client-supplied role data rather than validating the requester's privilege level against the action being performed. This aligns with the CWE-284 (Improper Access Control) classification assigned to the CVE.

Attack Vector

Exploitation requires network access to the FortiExtender management interface and valid low-privileged credentials. The attacker issues a crafted HTTP request to the user-creation endpoint containing parameters that assign administrator privileges. No user interaction is required, and the attack complexity is low. Refer to the FortiGuard Security Advisory FG-IR-23-459 for vendor technical details.

Detection Methods for CVE-2024-23663

Indicators of Compromise

Unexpected administrator or elevated-role accounts appearing in the FortiExtender user database
HTTP POST requests to user management endpoints originating from low-privileged sessions
Authentication events from newly created accounts shortly after their creation timestamps
Configuration changes performed by accounts that were not present in prior configuration backups

Detection Strategies

Audit FortiExtender local user lists and compare against an authoritative baseline of expected administrators
Correlate management-plane HTTP logs with role-change or user-creation activity from non-administrator sessions
Alert on any privilege elevation event tied to accounts created within the current session window

Monitoring Recommendations

Forward FortiExtender syslog and admin event logs to a centralized SIEM for retention and analysis
Enable alerting on user account creation, deletion, and role modification events
Restrict management interface exposure and monitor authentication attempts from unexpected source addresses

How to Mitigate CVE-2024-23663

Immediate Actions Required

Upgrade FortiExtender to a fixed firmware release as listed in the FortiGuard Security Advisory
Review all local FortiExtender user accounts and remove any unauthorized administrators
Rotate credentials for all administrative and service accounts on affected devices
Restrict management interface access to trusted administrative networks only

Patch Information

Fortinet has published fixed firmware versions in the FortiGuard PSIRT advisory FG-IR-23-459. Administrators should upgrade to a release above the affected ranges for their branch: post-4.1.9 and 4.2.6 on the 4.x tracks, post-7.0.4, 7.2.4, and 7.4.2 on the 7.x tracks. Version 5.3.2 is affected and requires migration to a supported patched branch.

Workarounds

Limit HTTPS and HTTP administrative access using trusted-host configuration to restrict which source IPs can reach the management interface
Disable unused administrative services and enforce strong, unique passwords for every local account
Segment FortiExtender management traffic onto a dedicated out-of-band management VLAN

bash

# Restrict administrative access to trusted hosts on FortiExtender CLI
config system admin
  edit "admin"
    set trusthost1 10.0.0.0 255.255.255.0
    set trusthost2 192.168.100.5 255.255.255.255
  next
end

# Disable HTTP and enforce HTTPS-only management
config system global
  set admin-http-port 0
  set admin-https-port 443
end