An out-of-bounds write in the FortiGate SSL VPN let unauthenticated attackers run code, and it was exploited in the wild. Versions to install and what to do if you cannot update.
Publicly disclosed: 8 February 2024
SSL VPN is one of the most used FortiGate features — and one of the most attacked. On 8 February 2024 Fortinet disclosed an out-of-bounds write in the SSL VPN component that allowed a remote, unauthenticated attacker to execute code with specially crafted HTTP requests. Fortinet stated it was potentially being exploited in the wild, and CISA added it to its exploited catalog the next day.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2024-21762 | Critical, CVSS 9.6 (out-of-bounds write, remote code execution) | FortiOS 6.0–7.4 with SSL VPN enabled; also FortiProxy | 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16 and later (6.0: migrate) |
The VPN gateway is the front door of the company. It needs patches first, not last.
Sources: Fortinet PSIRT FG-IR-24-015, NVD CVE-2024-21762.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
