Critical Remote Code Execution Vulnerability Found in FortiOS SSL VPN

9 February 2024 [NO.TCSA : 20240209-1-1-P]

PUBLISHED:
9 February 2024

Critical Remote Code Execution Vulnerability Found in FortiOS SSL VPN

A critical vulnerability, identified as CVE-2024-21762, has been discovered in FortiOS SSL VPN. This out-of-bounds write flaw, with a severity score of 9.6, allows unauthenticated attackers to execute arbitrary code remotely. It is believed to be actively exploited.

Affected Version

  • FortiOS 7.6: Not affected
  • FortiOS 7.4: 7.4.0 through 7.4.2
  • FortiOS 7.2: 7.2.0 through 7.2.6
  • FortiOS 7.0: 7.0.0 through 7.0.13
  • FortiOS 6.4: 6.4.0 through 6.4.14
  • FortiOS 6.2: 6.2.0 through 6.2.15
  • FortiOS 6.0: All versions

Mitigation

Fortinet recommends updating to the latest versions immediately. If immediate updating is not feasible, disabling SSL VPN is advised as a temporary measure.

Version Affected Solution
FortiOS 7.4 7.4.0 through 7.4.2 Upgrade to 7.4.3 or above
FortiOS 7.2 7.2.0 through 7.2.6 Upgrade to 7.2.7 or above
FortiOS 7.0 7.0.0 through 7.0.13 Upgrade to 7.0.14 or above
FortiOS 6.4 6.4.0 through 6.4.14 Upgrade to 6.4.15 or above
FortiOS 6.2 6.2.0 through 6.2.15 Upgrade to 6.2.16 or above
FortiOS 6.0 6.0 all versions Migrate to a fixed release

More Information

9 February 2024 [NO.TCSA : 20240209-1-1-P]

Critical Remote Code Execution Vulnerability Found in FortiOS SSL VPN

READ MORE READ MORE
13 July 2023 [NO.TCSA : 20230713-1-1-P]

Fortinet Patches Critical Remote Code Execution Vulnerability in FortiOS/FortiProxy

READ MORE READ MORE
23 June 2023 [NO.TCSA : 20230623-1-1-P]

WSO2 Releases Patches for Vulnerabilities in API Manager, Identity Server, and Other Products

READ MORE READ MORE
Read More BACK TO THREAT BULLETIN