CVE-2024-56169

What it actually does

The product fails to use its RPKI cache as a true fallback; a partial or failed fetch leaves the relying party with incomplete route origin validation data instead of reverting to the prior cached state.

Why it matters to the business

Network operators may silently lose visibility into route origins, increasing the chance of accepting invalid or hijacked routes and disrupting reliable internet routing decisions.

How an attack unfolds

An attacker who can influence or interrupt the RPKI fetch (for example by network disruption or serving malformed objects) causes the relying party to discard or ignore the partial data; because the cache is not used as a fallback, the validator operates with an incomplete dataset until the next successful fetch.

How to fix it

Upgrade Fort to version 2.0.0 or later so that the cache is properly maintained and used as a fallback when fetches fail or return incorrect data.

How to confirm the fix worked

After upgrade, simulate fetch failures or malformed responses and confirm that the validator continues to enforce route origin validation using the cached dataset without gaps.

Typical attack path

1. Identify a target RPKI relying party running an affected Fort version
2. Induce a fetch failure or supply malformed RPKI objects during the delta fetch window
3. Observe that the validator does not fall back to its local cache and therefore holds incomplete validation data
4. Advertise routes that would normally be rejected by full validation data

How to detect it

Review RPKI relying party logs for repeated fetch errors or warnings about incomplete datasets; correlate with BGP route acceptance events that bypass expected validation.

What your security team should do

• Prioritize upgrade of all Fort instances to 2.0.0 or newer within the next maintenance window
• Monitor EPSS and any new threat actor reporting; re-evaluate if exploitation activity appears
• Add RPKI fetch failure and validation coverage alerts to existing network monitoring