A allocation of resources without limits or throttling in Fortinet FortiSIEM 5.3 all versions, 5.4 all versions, 6.x all versions, 7.0 all versions, and 7.1.0 through 7.1.5 may allow an attacker to de

The primary impact of CVE-2024-46667 is a denial-of-service condition. An attacker can leverage this vulnerability to disrupt TLS traffic, rendering FortiSIEM unavailable for legitimate users. This can lead to significant operational disruptions, impacting security monitoring and incident response capabilities. The blast radius extends to any service relying on FortiSIEM for security data analysis and alerting. Successful exploitation could effectively blind an organization to ongoing security threats, allowing attackers to operate undetected.

Organizations heavily reliant on FortiSIEM for security monitoring and incident response are particularly at risk. Environments with limited network security controls or those lacking robust rate limiting capabilities are also more vulnerable. Shared hosting environments where multiple tenants share a single FortiSIEM instance could experience widespread disruption if one tenant exploits this vulnerability.

• fortinet: Monitor FortiSIEM logs for unusually high TLS connection rates from specific IP addresses. Use FortiSIEM's built-in reporting capabilities to identify potential DoS attacks.

Get-FortiSIEMLog -LogType 'Traffic' -Filter 'Protocol = 'TLS' -SortBy 'SourceIP, Count Descending' -Top 10

• generic web: Monitor network traffic for excessive TLS connection attempts to the FortiSIEM appliance. Use network intrusion detection systems (NIDS) to identify and block malicious traffic patterns.

tail -f /var/log/nginx/access.log | grep -i tls | awk '{print $1}' | sort | uniq -c | sort -nr | head -10

1. 2025-01-14Disclosure

   disclosure

1. Gereserveerd2024-09-11
2. Gepubliceerd2025-01-14
3. Gewijzigd2025-02-18
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-46667 is to upgrade FortiSIEM to version 7.1.6 or later, which contains the fix. If immediate upgrading is not possible, consider implementing rate limiting on incoming TLS connections to FortiSIEM. This can be achieved through network firewalls or intrusion prevention systems (IPS) configured to limit the number of TLS connections from a single source IP address. Monitor FortiSIEM resource utilization (CPU, memory, connections) for unusual spikes, which could indicate an ongoing attack. After upgrading, confirm the fix by attempting to induce the vulnerability and verifying that the system remains stable.