CVE-2024-50568: Fortinet FortiProxy Auth Bypass Vulnerability

CVE-2024-50568 Overview

CVE-2024-50568 is a channel accessible by non-endpoint vulnerability [CWE-300] affecting Fortinet FortiOS and FortiProxy. The flaw allows an unauthenticated attacker with knowledge of device-specific data to spoof the identity of a downstream device within the Fortinet Security Fabric. Exploitation occurs through crafted TCP requests directed at the affected instance. Successful attacks compromise the integrity of security fabric trust relationships without requiring credentials or user interaction.

Critical Impact
An unauthenticated network attacker can impersonate a downstream Security Fabric device, undermining the integrity of trust relationships between Fortinet appliances.

Affected Products

Fortinet FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, and versions before 7.0.14
Fortinet FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.9, and versions before 7.0.16
Fortinet Security Fabric deployments using vulnerable downstream device authentication

Discovery Timeline

2025-06-10 - CVE-2024-50568 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50568

Vulnerability Analysis

The vulnerability resides in the Security Fabric communication channel between upstream and downstream Fortinet devices. The channel does not sufficiently verify that the connecting party is a legitimate endpoint of the trusted communication path. An attacker positioned on the network can construct TCP requests that mimic the expected protocol exchange of a downstream device.

Because identity is established using device-specific data rather than a cryptographically bound endpoint identifier, an attacker who obtains that data can present themselves as a legitimate Security Fabric member. This breaks the assumption that a downstream device is authentic before the upstream device processes its inputs. The result is an integrity compromise affecting the fabric's trust model.

Root Cause

The root cause is a design weakness classified under [CWE-300] (Channel Accessible by Non-Endpoint). The Security Fabric protocol relies on knowledge of device-specific data to authenticate a downstream device instead of enforcing a mutually authenticated channel bound to an unforgeable endpoint identifier. Any actor holding that data can inject traffic into the channel.

Attack Vector

The attacker requires network reachability to the FortiOS or FortiProxy management or fabric service and prior knowledge of device-specific data used in the fabric handshake. No credentials and no user interaction are required. The attacker sends crafted TCP requests that emulate a downstream device joining or communicating within the Security Fabric. Successful exploitation grants the attacker the ability to spoof a trusted fabric member and influence data or state that the upstream device processes based on that trust.

See the Fortinet Security Advisory FG-IR-24-058 for vendor technical details.

Detection Methods for CVE-2024-50568

Indicators of Compromise

Unexpected Security Fabric join or authentication events originating from IP addresses not associated with known downstream FortiGate or FortiProxy devices.
Duplicate device identifiers appearing in fabric topology views or logs.
TCP connections to Security Fabric service ports from hosts outside the management or fabric network segment.

Detection Strategies

Correlate FortiOS and FortiProxy fabric authentication logs against an authoritative inventory of expected downstream devices.
Monitor for anomalous fabric protocol traffic patterns, including repeated handshake attempts or malformed TCP sequences targeting fabric ports.
Alert on Security Fabric topology changes that were not initiated through an approved change window.

Monitoring Recommendations

Ingest FortiOS and FortiProxy event logs into a centralized SIEM and baseline normal fabric join behavior.
Restrict monitoring scope for fabric communications to internal segments and alert on external sources reaching those ports.
Review authentication and topology audit logs after applying the patch to confirm no unauthorized fabric members remain.

How to Mitigate CVE-2024-50568

Immediate Actions Required

Upgrade FortiOS to a fixed release: 7.4.4 or later, 7.2.8 or later, or 7.0.14 or later per the vendor advisory.
Upgrade FortiProxy to a fixed release: 7.4.4 or later, 7.2.10 or later, or 7.0.16 or later per the vendor advisory.
Inventory all Security Fabric members and validate each device against an authoritative asset list.
Restrict network reachability to Security Fabric service ports so that only legitimate downstream devices can connect.

Patch Information

Fortinet has released fixed versions addressed in Fortinet Security Advisory FG-IR-24-058. Administrators should apply the corresponding patch train for their deployed major version. After patching, verify fabric membership and rotate any device-specific data used in fabric authentication where the vendor advisory recommends doing so.

Workarounds

Segment the Security Fabric communication network so fabric traffic is isolated from user and untrusted networks.
Apply firewall policies that permit fabric TCP ports only from the specific IP addresses of authorized downstream devices.
Disable Security Fabric integration on appliances that do not require downstream device federation until patches are applied.

bash

# Example: restrict Security Fabric service to trusted downstream device IPs
config firewall address
    edit "fabric_downstream_1"
        set subnet 10.10.20.11 255.255.255.255
    next
end
config firewall local-in-policy
    edit 10
        set intf "port1"
        set srcaddr "fabric_downstream_1"
        set dstaddr "all"
        set service "FortiFabric"
        set action accept
        set schedule "always"
    next
    edit 11
        set intf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set service "FortiFabric"
        set action deny
        set schedule "always"
    next
end