CVE-2024-40591: Fortinet FortiOS Privilege Escalation Flaw

CVE-2024-40591 Overview

CVE-2024-40591 is an incorrect privilege assignment vulnerability (CWE-266) affecting Fortinet FortiOS, the operating system powering FortiGate next-generation firewalls. This vulnerability allows an authenticated administrator with Security Fabric permissions to escalate their privileges to super-admin by connecting the targeted FortiGate device to a malicious upstream FortiGate under their control.

Critical Impact

Authenticated administrators can escalate to super-admin privileges through a malicious Security Fabric connection, potentially gaining complete control over the FortiGate appliance and compromising network security infrastructure.

Affected Products

• Fortinet FortiOS version 7.6.0
• Fortinet FortiOS versions 7.4.0 through 7.4.4
• Fortinet FortiOS versions 7.2.0 through 7.2.9
• Fortinet FortiOS versions before 7.0.15

Discovery Timeline

• 2025-02-11 - CVE-2024-40591 published to NVD
• 2025-07-17 - Last updated in NVD database

Technical Details for CVE-2024-40591

Vulnerability Analysis

This vulnerability resides in FortiOS's Security Fabric feature, which enables centralized management and communication between multiple Fortinet devices in an enterprise network. The flaw stems from improper privilege validation during the Security Fabric connection establishment process.

When a FortiGate device connects to an upstream FortiGate within the Security Fabric hierarchy, the system fails to adequately verify and restrict the privilege inheritance mechanism. An attacker who already possesses administrative access with Security Fabric permissions can exploit this weakness by configuring the target FortiGate to connect to a rogue FortiGate device under their control.

The attack requires network access and existing administrative credentials, but does not require user interaction. Upon successful exploitation, the attacker can achieve complete administrative control with super-admin privileges, allowing them to modify firewall rules, access sensitive configuration data, intercept network traffic, and potentially compromise the entire security infrastructure.

Root Cause

The root cause of CVE-2024-40591 is an incorrect privilege assignment (CWE-266) in the Security Fabric trust relationship mechanism. When processing upstream FortiGate connections, FortiOS does not properly validate whether the connecting administrator should inherit elevated privileges from the upstream device. This allows a lower-privileged administrator to leverage the trust relationship to gain unauthorized super-admin access.

Attack Vector

The attack is conducted over the network and requires the following conditions:

1. The attacker must have valid administrative credentials with Security Fabric permissions on the target FortiGate
2. The attacker must control a separate FortiGate device (or emulate one) that can act as a malicious upstream device
3. The attacker configures the target FortiGate to join a Security Fabric with the attacker-controlled device as the upstream root
4. Upon establishing the Security Fabric connection, the attacker's privileges are escalated to super-admin on the target device

The vulnerability exploits the implicit trust within Security Fabric connections, where downstream devices accept privilege configurations from upstream devices without adequate verification.

Detection Methods for CVE-2024-40591

Indicators of Compromise

• Unexpected Security Fabric topology changes or new upstream FortiGate connections
• Administrator accounts suddenly gaining super-admin privileges without authorized changes
• Configuration modifications to Security Fabric settings from non-super-admin accounts
• Log entries indicating Security Fabric connection attempts to unfamiliar or unauthorized upstream devices

Detection Strategies

• Monitor FortiGate audit logs for Security Fabric configuration changes, particularly set upstream commands
• Alert on privilege elevation events where administrators gain super-admin access
• Implement network monitoring to detect FortiGate-to-FortiGate communication with unauthorized IP addresses
• Review Security Fabric topology regularly to identify rogue or unauthorized upstream devices

Monitoring Recommendations

• Enable comprehensive logging for all administrative actions and Security Fabric events
• Configure SIEM rules to correlate Security Fabric connection events with subsequent privilege changes
• Establish baseline Security Fabric topologies and alert on deviations
• Monitor for outbound connections from FortiGate management interfaces to unknown destinations

How to Mitigate CVE-2024-40591

Immediate Actions Required

• Upgrade FortiOS to patched versions: 7.6.1 or later, 7.4.5 or later, 7.2.10 or later, or 7.0.16 or later
• Review and restrict which administrators have Security Fabric permissions
• Audit current Security Fabric configurations to ensure only authorized upstream devices are configured
• Implement strict network segmentation for FortiGate management interfaces

Patch Information

Fortinet has released security updates to address this vulnerability. Organizations should review the official Fortinet Security Advisory FG-IR-24-302 for detailed patch information and upgrade to the recommended FortiOS versions. The advisory provides specific version requirements for each affected branch.

Workarounds

• Restrict Security Fabric permissions to only essential personnel with verified need
• Implement network access controls to prevent FortiGate devices from connecting to unauthorized upstream devices
• Configure firewall rules to limit management plane communication to known, trusted FortiGate devices only
• Consider temporarily disabling Security Fabric functionality if not actively required until patches can be applied