CVE DatabaseCVE-2024-21762

Updated 2026-10-22한국어 권고문 →

CVE-2024-217629.8/CRITICALCISA KEVCWE-787

Fortinet FortiOS and FortiProxy SSL-VPN Out-of-bounds Write Remote Code Execution Vulnerability (CVE-2024-21762) Critical Security Advisory

⚡ Jump to Patch

Affected Vendors

fortinet

Affected Components

fortios, fortiproxy

Published Date

2024-02-09

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

84.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

FortiOS versions 6.0 through 7.4.2 and FortiProxy versions 1.0 through 7.4.2 with SSL-VPN service enabled

Impact

Unauthenticated remote attackers can execute arbitrary code or commands on the target system via specially crafted HTTP requests

Mitigation

Immediately upgrade to the patched firmware versions, or disable the SSL-VPN service as a temporary workaround

Affected Products & Version Scope

FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15, all 6.0 versions; FortiProxy 7.4.0-7.4.2, 7.2.0-7.2.8, 7.0.0-7.0.14, 2.0.0-2.0.13, and all 1.0-1.2 versions (when SSL-VPN is enabled)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is to upgrade FortiOS/FortiProxy to the latest patched versions. Verify your current version and perform the upgrade using the CLI commands below:

bash

# Check current FortiOS system status and version
get system status

# Restore/Upgrade firmware image via TFTP server
execute restore image tftp <firmware_image_name> <tftp_server_ip>

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, disable the SSL-VPN service to mitigate the attack vector. Execute the following CLI commands to disable SSL-VPN:

bash

# Disable SSL-VPN daemon status
config vpn ssl settings
    set status disable
end

3. Log Audit & IoC Verification Commands

Monitor the system crash logs for any abnormal terminations of the SSL-VPN daemon, which may indicate exploitation attempts:

bash

# Read crash logs and filter for sslvpnd process crashes
diagnose debug crashlog read | grep -i 'sslvpnd'

# Monitor real-time SSL-VPN connection logs
diagnose debug application sslvpn -1

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active in-the-wild exploitation, immediately upgrade your FortiOS/FortiProxy devices or disable the SSL-VPN service.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-21762) is an out-of-bounds write flaw (CWE-787) residing in the SSL-VPN daemon (sslvpnd) of Fortinet FortiOS and FortiProxy. When the SSL-VPN web portal is enabled, the system fails to properly validate the length of incoming HTTP request headers and payloads, leading to memory corruption when parsing malformed inputs.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the SSL-VPN listening port (typically TCP 443 or 10443). By manipulating HTTP Chunked Transfer Encoding or Content-Length headers, the attacker triggers a heap-based buffer overflow within the sslvpnd process. This allows the attacker to overwrite critical memory structures, hijack the execution flow, and execute arbitrary commands with root privileges.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat as it is actively exploited in the wild. Successful exploitation grants full administrative control over the perimeter security device, enabling attackers to perform lateral movement, intercept internal network traffic, harvest credentials, and deploy ransomware.

Official Vendor Advisories & References

NVD Original English Description

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests

https://fortiguard.com/psirt/FG-IR-24-015

Source: psirt@fortinet.com · Vendor Advisory

https://fortiguard.com/psirt/FG-IR-24-015

Source: af854a3a-2127-422b-91ae-364da2661108 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2024-21762)

FAQ

Q1. How critical is CVE-2024-21762 and is it actively exploited in the wild?

CVE-2024-21762 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 84.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-21762?

Primary impacted vendors include fortinet across fortios, fortiproxy. Scope summary: FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15, all 6.0 versions; FortiProxy 7.4.0-7.4.2, 7.2.0-7.2.8, 7.0.0-7.0.14, 2.0.0-2.0.13, and all 1.0-1.2 versions (when SSL-VPN is enabled)

Q3. What temporary mitigations or workarounds exist for CVE-2024-21762 before patching?

[Mitigation] Immediately upgrade to the patched firmware versions, or disable the SSL-VPN service as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION