CVE-2024-35279 in FortiOS
Summary
by MITRE • 02/11/2025
A stack-based buffer overflow [CWE-121] vulnerability in Fortinet FortiOS version 7.2.4 through 7.2.8 and version 7.4.0 through 7.4.4 allows a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets through the CAPWAP control, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/17/2025
This vulnerability represents a critical stack-based buffer overflow flaw classified as CWE-121 within Fortinet FortiOS software versions 7.2.4 through 7.2.8 and 7.4.0 through 7.4.4. The vulnerability specifically affects the CAPWAP control protocol implementation and can be exploited through crafted UDP packets transmitted to the affected system. The flaw occurs when the device processes incoming CAPWAP control messages without proper bounds checking, allowing an attacker to overwrite adjacent memory locations on the stack. This type of vulnerability falls under the broader category of memory safety issues that have been extensively documented in cybersecurity literature and represents a significant risk to network infrastructure security.
The attack vector requires the exploitation of a remote unauthenticated attacker who can send specially crafted UDP packets to the vulnerable FortiOS device. The vulnerability is particularly concerning because it can be leveraged to achieve arbitrary code execution or command execution on the affected system. The exploitation process would typically involve crafting UDP packets that exceed the allocated buffer size in the CAPWAP control processing code, causing a buffer overflow that can be manipulated to overwrite return addresses or other critical stack data. This type of attack aligns with the attack techniques documented in the MITRE ATT&CK framework under the T1059 category for command and script execution, and T1203 for legitimate user privileges.
The operational impact of this vulnerability extends beyond simple code execution as it can provide attackers with full control over the affected FortiOS device, potentially allowing them to establish persistent access to the network infrastructure. The requirement for the fabric service to be running on an exposed interface means that organizations with improperly configured firewalls or exposed management interfaces are particularly at risk. The fact that this vulnerability affects multiple version ranges indicates a widespread issue that could impact numerous Fortinet deployments across different network environments. Organizations using FortiOS versions within the affected ranges should consider this vulnerability as a high-priority threat requiring immediate attention and remediation.
The exploitation of this vulnerability requires the attacker to overcome FortiOS stack protection mechanisms, suggesting that the software implements some form of stack canary or similar protection. However, the presence of this vulnerability indicates that these protections may be bypassable or that the buffer overflow occurs in a location where such protections are ineffective. Network administrators should implement immediate mitigations including firewall rules to restrict access to CAPWAP control ports, disabling unused fabric services, and applying the latest Fortinet security patches as soon as they become available. The vulnerability also highlights the importance of proper network segmentation and the principle of least privilege in network security architecture, as demonstrated by the ATT&CK framework's emphasis on reducing attack surface through proper network design and access controls. Organizations should also consider implementing network monitoring solutions to detect anomalous UDP traffic patterns that could indicate exploitation attempts against this vulnerability.