PT-2023-8534 · Fortinet · Fortiproxy+1

Published 2023-02-09 · Updated 2026-05-25 · CVE-2024-21762

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 6.0.0 through 7.4.2 and FortiProxy versions 2.0.0 through 7.4.2

Description Fortinet FortiOS and FortiProxy contain an out-of-bounds write vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted HTTP requests. This vulnerability is actively being exploited in the wild, with approximately 150,000 systems potentially affected globally, with a high concentration in the United States. Exploitation allows for remote code execution (RCE). A proof-of-concept (PoC) exploit is available. The vulnerability resides in the sslvpnd component.

Recommendations Fortinet FortiOS versions 6.0.0 through 7.4.2: Upgrade to a fixed version or disable SSL VPN as a temporary workaround. FortiProxy versions 2.0.0 through 7.4.2: Upgrade to a fixed version or disable SSL VPN as a temporary workaround.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2024-01125

CVE-2024-21762

FORTINETSSLVPN_CVE_2024_21762

Affected Products

Fortios

Fortiproxy

References · 390

• 🔥 https://github.com/h4x0r-dz/CVE-2024-21762 · Exploit
• 🔥 https://github.com/BishopFox/cve-2024-21762-check · Exploit
• 🔥 https://github.com/r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check · Exploit
• 🔥 https://github.com/cleverg0d/CVE-2024-21762-Checker · Exploit
• 🔥 https://github.com/d0rb/CVE-2024-21762 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-21762-poc · Exploit
• 🔥❌ https://github.com/c0d3b3af/CVE-2024-21762-POC · Exploit, Deleted
• 🔥❌ https://github.com/c0d3b3af/CVE-2024-21762-Exploit · Exploit, Deleted
• 🔥❌ https://github.com/JohnHormond/CVE-2024-21762-Fortinet-RCE-WORK · Exploit, Deleted
• 🔥❌ https://github.com/AlexLondan/CVE-2024-21762-Fortinet-RCE-ALLWORK · Exploit, Deleted
• 🔥❌ https://github.com/c0d3b3af/CVE-2024-21762-RCE-exploit · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2024-21762 · Security Note
• https://fortiguard.com/psirt/FG-IR-24-015 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21762 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/705881 · Security Note