CVE-2024-46667
📋 TL;DR
This vulnerability in Fortinet FortiSIEM allows attackers to cause denial of service by consuming all available TLS connections through resource allocation without limits. It affects all versions of FortiSIEM 5.3, 5.4, 6.x, 7.0, and versions 7.1.0 through 7.1.5. Organizations using these vulnerable versions are at risk of service disruption.
💻 Affected Systems
- Fortinet FortiSIEM
📦 What is this software?
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
Fortisiem by Fortinet
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service for FortiSIEM, preventing security monitoring and alerting capabilities across the organization.
Likely Case
Intermittent service degradation or complete outage of FortiSIEM security monitoring functions.
If Mitigated
Minimal impact with proper network segmentation and connection rate limiting in place.
🎯 Exploit Status
Exploitation requires network access to FortiSIEM TLS endpoints but no authentication. Attackers need to establish and maintain numerous TLS connections.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FortiSIEM 7.1.6 and later
Vendor Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-24-164
Restart Required: No
Instructions:
1. Download FortiSIEM 7.1.6 or later from Fortinet support portal. 2. Follow Fortinet's upgrade documentation for your deployment type. 3. Apply the update during maintenance window. 4. Verify successful upgrade.
🔧 Temporary Workarounds
Network segmentation and access control
allRestrict network access to FortiSIEM TLS endpoints to trusted sources only.
Connection rate limiting
allImplement network-level connection rate limiting using firewalls or load balancers.
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to FortiSIEM interfaces
- Deploy network-based DDoS protection and connection rate limiting
🔍 How to Verify
Check if Vulnerable:
Check FortiSIEM version via web interface (System > About) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify version is 7.1.6 or later after patching and monitor for TLS connection exhaustion📡 Detection & Monitoring
Log Indicators:
- Unusually high TLS connection counts
- Connection timeout errors
- Resource exhaustion warnings
Network Indicators:
- Spike in TLS handshake attempts to FortiSIEM ports
- Multiple connections from single sources
SIEM Query:
source="fortisiem" AND ("connection limit" OR "resource exhausted" OR "TLS handshake failed")