CVE-2024-46670

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.6.0 through 7.4.4 and earlier FortiOS versions 7.2.9 and earlier FortiSASE FortiOS tenant version 24.3.b

Description The issue is related to an out-of-bounds read vulnerability in the IPsec IKE service of FortiOS and FortiSASE FortiOS tenant. This vulnerability may allow an unauthenticated remote attacker to trigger memory consumption, leading to a denial of service via crafted requests.

Recommendations For FortiOS versions 7.6.0 through 7.4.4 and earlier, update to a version that contains a fix for this issue. For FortiOS versions 7.2.9 and earlier, update to a version that contains a fix for this issue. For FortiSASE FortiOS tenant version 24.3.b, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the IPsec IKE service to minimize the risk of exploitation.