CVE-2024-23113: FortiGate FGFM Protocol Externally Controlled Format String RCE
An externally-controlled format string vulnerability [CWE-134] in FortiOS fgfmd daemon (TCP port 541) allows remote unauthenticated threat actors to execute arbitrary code or trigger denial of service via crafted management packets.
Technical Root Cause Analysis
The FortiGate to FortiManager (FGFM) communication protocol daemon, /bin/fgfmd, listens by default on TCP port 541 across any interface where the fgfm administrative access option is enabled. The protocol implements an exchange sequence used for device discovery, serial registration, central configuration synchronization, and firmware management.
During the initial FGFM handshake processing, client-provided parameter values (including device identification strings and message metadata) are copied into logging and status reporting subroutines. In vulnerable builds, the internal function fgfm_log_format passes untrusted payload strings directly as the format parameter to internal formatting functions rather than using a static format specifier such as "%s".
An attacker sending strings containing format specifiers (such as %n, %p, %x) can read arbitrary stack memory or overwrite target memory addresses in the daemon's address space, achieving pre-authentication remote code execution with root system privileges.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.4 | 7.4.0 – 7.4.4 | 7.4.5+ | Remove fgfm on WAN; upgrade firmware |
| FortiOS 7.2 | 7.2.0 – 7.2.8 | 7.2.9+ | Remove fgfm on WAN; local-in policy |
| FortiOS 7.0 | 7.0.0 – 7.0.15 | 7.0.16+ | Remove fgfm on WAN; upgrade to 7.0.16 |
| FortiOS 7.6 | Not Affected | 7.6.0+ Clean | Format validation enforced by design |
Platform Impact: Affects all FortiGate models where the fgfm service is exposed to network interfaces. FortiProxy (7.0.x, 7.2.x, 7.4.x) and FortiPAM appliances are also subject to this vulnerability if FGFM is active.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands via SSH or console to audit the FGFM daemon, evaluate interface bindings, and confirm whether TCP 541 is accessible on untrusted perimeters:
Diagnostic Commands
# 1. Verify FGFM daemon process ID and memory consumption
diagnose sys process pidof fgfmd
# 2. Query FGFM application operational metrics and connection state
diagnose test application fgfmd 1
# 3. Identify all network interfaces where the FGFM protocol (TCP 541) is currently enabled
show system interface | grep "allowaccess.*fgfm"Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
The FortiOS fgfmd daemon evaluates client handshake strings through formatted string routines without specifying format strings (e.g., "%s"), permitting attacker-controlled format specifiers (%n, %p) to overwrite memory registers and execute arbitrary code.
Yes. You can preserve FortiManager connectivity by configuring local-in firewall rules that restrict inbound TCP 541 connections strictly to your authorized FortiManager IP address, preventing unauthorized external access.
Fortinet released fixes in FortiOS 7.0.16, 7.2.9, and 7.4.5. FortiOS 7.6.0 and subsequent builds are clean.