CVE-2024-46666: Fortinet FortiOS DOS Vulnerability

CVE-2024-46666 Overview

CVE-2024-46666 is a resource allocation vulnerability [CWE-770] affecting multiple versions of Fortinet FortiOS. A remote unauthenticated attacker can send specially crafted requests to specific endpoints and prevent legitimate access to the management GUI. The flaw impacts FortiOS 7.6.0, versions 7.4.0 through 7.4.4, all 7.2.x releases, all 7.0.x releases, and all 6.4.x releases. Fortinet published the advisory as FG-IR-24-250. The issue does not affect data confidentiality or integrity, but disrupts administrator access to the appliance interface.

Critical Impact
Unauthenticated remote attackers can render the FortiOS management GUI unavailable, obstructing administrative operations and incident response.

Affected Products

Fortinet FortiOS 7.6.0
Fortinet FortiOS 7.4.0 through 7.4.4
Fortinet FortiOS 7.2.x, 7.0.x, and 6.4.x (all versions)

Discovery Timeline

2025-01-14 - CVE-2024-46666 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-46666

Vulnerability Analysis

The vulnerability is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. FortiOS accepts requests on specific GUI endpoints without enforcing bounds on the resources consumed per request or per client. An unauthenticated attacker sending crafted requests can exhaust the resources needed to serve the management interface. The result is a denial-of-service condition limited to GUI availability. Data planes and control planes outside the affected endpoints are not identified in the advisory as impacted.

Root Cause

The root cause is missing throttling and quota enforcement on selected FortiOS web management endpoints. Because these endpoints process requests before authentication checks limit resource commitment, an attacker does not need credentials to trigger exhaustion. The absence of per-source rate limiting and connection accounting allows a single actor to sustain the condition with modest bandwidth.

Attack Vector

Exploitation occurs over the network against the FortiOS administrative interface. The attacker directs specially crafted requests at the vulnerable endpoints, forcing the appliance to allocate resources faster than they are released. Sustained requests keep the GUI unreachable for administrators. Refer to the Fortinet Security Advisory FG-IR-24-250 for endpoint-specific details.

No public proof-of-concept code is available for CVE-2024-46666 at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-46666

Indicators of Compromise

Sudden loss of access to the FortiOS management GUI while the data plane remains operational
High volume of HTTP/HTTPS requests to specific management endpoints from a single or small set of source IP addresses
Elevated CPU or memory usage on the FortiOS management process during the outage window

Detection Strategies

Alert on anomalous spikes in requests to FortiOS administrative endpoints, particularly from untrusted networks
Correlate FortiOS system logs showing management process resource pressure with concurrent network telemetry
Deploy signatures that identify repeated requests to the endpoints described in FG-IR-24-250 once Fortinet publishes indicators

Monitoring Recommendations

Continuously monitor availability of the FortiOS GUI using external synthetic checks
Forward FortiOS event and traffic logs to a centralized analytics platform for baseline deviation analysis
Track source IP diversity and request rates targeting the / management interface and API endpoints

How to Mitigate CVE-2024-46666

Immediate Actions Required

Identify all FortiOS devices running affected versions and prioritize internet-exposed management interfaces
Apply the fixed FortiOS release identified in FG-IR-24-250
Restrict administrative access to trusted management networks and known jump hosts

Patch Information

Fortinet has published fixed FortiOS versions in advisory FG-IR-24-250. Administrators should upgrade to the vendor-recommended release for their branch. Confirm the running version with get system status before and after the upgrade to validate remediation.

Workarounds

Limit management interface exposure by binding the GUI to internal interfaces only
Enforce trusthost restrictions on administrator accounts to permit only approved source addresses
Place the management interface behind a VPN or bastion host and disable direct internet reachability
Apply upstream rate limiting on network devices to slow request floods against the GUI

bash

# Configuration example - restrict admin access to trusted networks
config system admin
    edit "admin"
        set trusthost1 10.0.0.0 255.255.255.0
        set trusthost2 192.168.100.0 255.255.255.0
    next
end

# Disable HTTPS management access on untrusted interfaces
config system interface
    edit "wan1"
        unset allowaccess
    next
end