CVE-2024-45324: Fortinet FortiOS RCE Vulnerability

CVE-2024-45324 Overview

CVE-2024-45324 is an externally-controlled format string vulnerability [CWE-134] affecting multiple Fortinet products, including FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiWeb. The flaw allows a privileged attacker to execute unauthorized code or commands by sending specially crafted HTTP or HTTPS requests to affected devices. Fortinet disclosed the issue in advisory FG-IR-24-325, and the vulnerability was published to NVD on March 11, 2025.

Critical Impact
An authenticated attacker with high privileges can achieve arbitrary code execution on network security appliances, compromising confidentiality, integrity, and availability of the affected device.

Affected Products

FortiOS 7.4.0 through 7.4.4, 7.2.0 through 7.2.9, 7.0.0 through 7.0.15, and all versions before 6.4.15
FortiProxy 7.4.0 through 7.4.6, 7.2.0 through 7.2.12, and all versions before 7.0.19
FortiPAM 1.4.0 through 1.4.2 and versions before 1.3.1; FortiSRA 1.4.0 through 1.4.2 and versions before 1.3.1; FortiWeb 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and versions before 7.0.10

Discovery Timeline

2025-03-11 - CVE-2024-45324 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45324

Vulnerability Analysis

The vulnerability is a classic use of an externally-controlled format string, categorized under [CWE-134]. Fortinet software passes attacker-supplied input from HTTP or HTTPS requests into a formatting function without proper sanitization. When format specifiers such as %s, %x, or %n appear in that input, the underlying printf-family function interprets them as directives rather than literal data. This behavior allows attackers to read from or write to arbitrary memory locations on the device.

Because the affected components run within privileged management or proxy processes, successful exploitation results in code execution in a trusted context. The vulnerability requires network access to the management interface and a high-privilege authenticated session.

Root Cause

The root cause is the passing of untrusted user input directly as the format string argument to a formatting function. Secure coding practice requires passing user data through a fixed format specifier such as printf("%s", user_input) rather than printf(user_input). The affected Fortinet HTTP/HTTPS command handlers omit this safeguard for certain administrative parameters.

Attack Vector

An attacker with valid high-privilege credentials sends a crafted HTTP or HTTPS command to the management or administrative interface of an affected device. The request contains format specifiers embedded in fields that reach the vulnerable formatting routine. Processing the specifiers leaks stack contents, corrupts memory through %n, or redirects execution to attacker-controlled code paths. No user interaction is required beyond the attacker's own authenticated session.

Because realCodeExamples are not available, refer to the Fortinet Security Advisory FG-IR-24-325 for vendor-provided technical details.

Detection Methods for CVE-2024-45324

Indicators of Compromise

HTTP or HTTPS requests to the management interface containing format specifier tokens such as %s, %x, %p, or %n inside administrative parameters.
Unexpected httpsd, cmdbsvr, or related management daemon crashes, restarts, or core dumps on FortiOS, FortiProxy, FortiPAM, FortiSRA, or FortiWeb devices.
Administrator sessions originating from unfamiliar source addresses that immediately issue unusual API or CLI-over-HTTP commands.

Detection Strategies

Inspect web application firewall and reverse proxy logs for admin API requests containing raw format specifiers in URL parameters, headers, or body fields.
Correlate authenticated admin activity with anomalous process behavior on Fortinet devices, including segmentation faults or memory access violations recorded in device diagnostic logs.
Alert on privilege-elevation events or configuration changes made shortly after an unusual admin login from a new geolocation or user agent.

Monitoring Recommendations

Forward Fortinet syslog and event logs to a centralized SIEM and build detections for repeated 400/500 responses on /api/v2/ or GUI endpoints.
Monitor administrative account usage baselines and alert on high-privilege logins outside normal maintenance windows.
Track firmware version inventory across all Fortinet appliances and flag any device still running a version listed as affected in FG-IR-24-325.

How to Mitigate CVE-2024-45324

Immediate Actions Required

Upgrade affected devices to the fixed releases identified in Fortinet Security Advisory FG-IR-24-325.
Restrict access to the management interface to trusted administrative networks only, and disable HTTP/HTTPS administrative access on WAN-facing interfaces.
Rotate credentials for all administrator accounts and enforce multi-factor authentication for privileged access.

Patch Information

Fortinet has released fixed builds for FortiOS, FortiProxy, FortiPAM, FortiSRA, and FortiWeb. Consult Fortinet Security Advisory FG-IR-24-325 for the specific target versions per product line and apply the vendor-recommended upgrade path.

Workarounds

Limit management-interface exposure using trusted host entries so only pre-approved source addresses can authenticate to the administrative interface.
Place management interfaces behind a dedicated out-of-band network or VPN and block direct internet access to those interfaces at the perimeter.
Reduce the number of accounts assigned super_admin or equivalent roles until patched builds are deployed.

bash

# Restrict admin access to a trusted management subnet on FortiOS
config system admin
    edit "admin"
        set trusthost1 10.10.0.0 255.255.255.0
        set accprofile "super_admin"
    next
end

# Disable HTTP/HTTPS admin access on WAN interfaces
config system interface
    edit "wan1"
        unset allowaccess
        set allowaccess ping
    next
end