CVE-2024-21762

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.4.0 through 7.4.2 FortiOS versions 7.2.0 through 7.2.6 FortiOS versions 7.0.0 through 7.0.13 FortiOS versions 6.4.0 through 6.4.14 FortiOS versions 6.2.0 through 6.2.15 FortiOS versions 6.0.0 through 6.0.17 FortiProxy versions 7.4.0 through 7.4.2 FortiProxy versions 7.2.0 through 7.2.8 FortiProxy versions 7.0.0 through 7.0.14 FortiProxy versions 2.0.0 through 2.0.13 FortiProxy versions 1.2.0 through 1.2.13 FortiProxy versions 1.1.0 through 1.1.6 FortiProxy versions 1.0.0 through 1.0.7

Description An out-of-bounds write (a condition where data is written outside the intended memory buffer) in the sslvpnd service allows a remote unauthenticated attacker to execute unauthorized code or commands. This is achieved by sending specifically crafted HTTP requests. Real-world exploitation has been observed, including an incident involving a large broadband provider in Thailand where attackers targeted internal systems and subscriber authentication databases. Technical analysis indicates that attackers may fingerprint the target device to select specific shellcode based on the architecture (such as ARM or AMD64) to execute code and exfiltrate configuration files from the /data/config/ directory.

Recommendations As a temporary workaround for all affected versions of FortiOS and FortiProxy, disable the SSL VPN. Note that disabling webmode is not an effective mitigation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.