Fortinet exploit used in the Wild | CVE-2024-21762

Fortinet Firewall SSL VPN

• CVE: CVE-2024-21762
• Severity: CRITICAL
• Priority: CRITICAL

Summary

• Fortinet is warning that a new critical remote code execution vulnerability in FortiOS SSL VPN is potentially being exploited in attacks.
• You will only be impacted if your SSL VPN portal is accessible to the public.
• The flaw (tracked as CVE-2024-21762 / FG-IR-24-015) received a 9.6 severity rating and is an out-of-bounds write vulnerability in FortiOS that allows unauthenticated attackers to gain remote code execution (RCE) via maliciously crafted requests.

Out-of-bound Write in SSLVPND

• An out-of-bounds write vulnerability [CWE-787] in FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests.
• Note: This is potentially being exploited in the wild.

Remediation

• Upgrade to Unaffected Version
• Disable SSL VPN (disable webmode is NOT a valid workaround)