CVE-2024-52963: Fortinet FortiOS DoS Vulnerability

CVE-2024-52963 Overview

CVE-2024-52963 is an out-of-bounds write vulnerability [CWE-787] affecting multiple versions of Fortinet FortiOS. A remote attacker can send specially crafted packets to trigger a denial of service condition on the affected device. The flaw impacts FortiOS 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15. Exploitation requires no authentication and no user interaction, but attack complexity is high. Successful exploitation impacts device availability without compromising confidentiality or integrity.

Critical Impact

A remote attacker can send crafted network packets to cause a denial of service on affected FortiOS devices, potentially disrupting perimeter security and network connectivity.

Affected Products

• Fortinet FortiOS 7.6.0
• Fortinet FortiOS 7.4.0 through 7.4.6, 7.2.0 through 7.2.10
• Fortinet FortiOS 7.0.0 through 7.0.16 and 6.4.0 through 6.4.15

Discovery Timeline

• 2025-01-14 - CVE-2024-52963 published to the National Vulnerability Database (NVD)
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52963

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] within FortiOS packet handling logic. When the affected code processes a specially crafted packet, it writes data beyond the boundaries of an allocated buffer. This memory corruption disrupts process state and forces the affected component to terminate or restart, producing a denial of service condition.

Because FortiOS operates as the underlying operating system for FortiGate perimeter devices, service disruption directly affects firewalling, VPN termination, and inspection traffic. The advisory scopes the impact to availability only, with no confidentiality or integrity impact reported by the vendor.

Root Cause

The root cause is improper validation of length or offset values during packet parsing, which allows attacker-controlled input to trigger a write past the intended buffer boundary. Fortinet has not published low-level details in the public advisory. Refer to the Fortinet Security Advisory FG-IR-24-373 for vendor-supplied information.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends specially crafted packets to a reachable FortiOS interface. Attack complexity is high, indicating that reliable exploitation depends on conditions outside the attacker's direct control, such as timing or specific device state. Successful exploitation results in denial of service rather than code execution.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-52963

Indicators of Compromise

• Unexpected process crashes, restarts, or failovers on FortiOS devices without administrator-initiated changes.
• Repeated crash log entries or kernel panics tied to packet-processing subsystems.
• Loss of connectivity through the FortiGate coincident with anomalous inbound traffic patterns.

Detection Strategies

• Monitor FortiOS system event logs for abnormal daemon terminations and HA failover events on versions listed in FG-IR-24-373.
• Correlate SNMP or syslog availability signals with upstream packet captures to identify malformed traffic preceding outages.
• Alert on inbound traffic that matches unusual protocol structures directed at management or data-plane interfaces.

Monitoring Recommendations

• Forward FortiOS syslog and crashlog data to a centralized analytics platform for correlation across the fleet.
• Track patch state across all FortiGate devices and flag any unit still running an affected build.
• Baseline normal packet distributions per interface so that malformed or anomalous flows can be detected during triage.

How to Mitigate CVE-2024-52963

Immediate Actions Required

• Inventory all Fortinet FortiOS devices and identify units running affected versions in the 6.4, 7.0, 7.2, 7.4, and 7.6.0 branches.
• Apply the fixed FortiOS builds published in FG-IR-24-373 according to the vendor's upgrade guidance.
• Restrict management interface exposure and limit untrusted network access to FortiOS data-plane interfaces where feasible.

Patch Information

Fortinet provides fixed releases and upgrade guidance in the Fortinet Security Advisory FG-IR-24-373. Siemens has issued corresponding guidance for affected OT deployments in Siemens Product Security Advisory SSA-864900. Administrators should follow the vendor's version matrix to select an appropriate fixed release for each branch in use.

Workarounds

• No official workaround is published by the vendor; upgrading to a fixed FortiOS release is the recommended remediation.
• Reduce the attack surface by limiting inbound reachability to FortiOS interfaces from untrusted networks using upstream ACLs.
• Enable high-availability configurations so that a crashing unit fails over to a peer while remediation is applied.

# Check current FortiOS version to determine exposure
get system status | grep Version

# Restrict management access to trusted sources
config system interface
    edit <interface>
        set trust-ip-1 <trusted_subnet>
    next
end