Buffer overflow in fgfmd

Summary

A stack-based overflow vulnerability [CWE-124] in FortiOS, FortiProxy, FortiPAM and FortiSwitchManager may allow a remote attacker to execute arbitrary code or command via crafted packets reaching the fgfmd daemon, under certain conditions which are outside the control of the attacker.

Workaround :

For each interface, remove the fgfm access, for example change :

config system interface

edit "portX"
     set allowaccess ping https ssh **fgfm**
next

end

to :

config system interface

edit "portX"
     set allowaccess ping https ssh
next

end

Note that this will prevent FortiGate discovery from FortiManager. Connection will still be possible from FortiGate.

Please also note that a local-in policy that only allows FGFM connections from a specific IP will reduce the attack surface but it won't prevent the vulnerability from being exploited from this IP. As a consequence, this should be used as a mitigation and not as a complete workaround.

Acknowledgement

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team.

Timeline

2025-06-23: Initial publication