CVE-2024-21762

This flaw is like a “memory write bug” that a bad actor can trigger by sending specially crafted messages to the Fortinet device. Because it can let attackers run unauthorized commands without logins, it can quickly turn a firewall/proxy into a foothold for ransomware or other attacks. The practical result is that an attacker may gain control of the device and use it to disrupt services or reach internal networks.

This matters if your business uses Fortinet FortiOS and/or FortiProxy, especially if those systems handle internet-facing network traffic. The vulnerability can be triggered remotely and does not require a login, which increases the risk when the device is reachable from outside. Whether it’s reachable in a “default” setup isn’t confirmed here, so treat it as a risk whenever the affected service could be accessed from the internet.

This is RED because the issue is in the CISA KEV list and was used in ransomware campaigns—meaning attackers are actively exploiting it in the real world. Don’t treat this like a theoretical problem; you should upgrade or apply the vendor mitigations immediately. CISA’s KEV remediation due date was 2024-02-16, so you should prioritize this as an urgent security outage prevention task.

Confirm whether you’re affected

1. Identify your footprint: locate all devices running Fortinet FortiOS and Fortinet FortiProxy.
2. For each device, record the exact firmware/version number.
3. Compare your versions to the affected ranges:
   • FortiOS: 6.0.0 through 6.0.17, 6.2.0 through 6.2.15, 6.4.0 through 6.4.14, 7.0.0 through 7.0.13, 7.2.0 through 7.2.6, 7.4.0 through 7.4.2 (per the provided title).
   • FortiProxy: 1.0.0 through 1.0.7, 1.1.0 through 1.1.6, 1.2.0 through 1.2.13, 2.0.0 through 2.0.13, 7.0.0 through 7.0.14, 7.2.0 through 7.2.8, 7.4.0 through 7.4.2.

Apply the fixed versions (target branches)

• FortiProxy: upgrade to 2.0.14 (or higher), or 7.0.15+, or 7.2.9+, or 7.4.3+ depending on your branch.
• FortiOS: upgrade to 6.0.18 (or higher fixed versions for your supported line).

Mitigation while upgrading (if you can’t patch immediately)

• Follow Fortinet’s mitigation instructions for FG-IR-24-015.
• The provided vendor guidance includes a compensating measure: disable the sslvpnd service.

CISA timing

• CISA KEV due date for remediation: 2024-02-16.

After patching: what to monitor

• Check logs/network monitoring for suspicious remote requests related to exploit attempts.
• Confirm devices are actually running the new fixed versions and that the mitigations (if used temporarily) are reflected in the configuration.

Operational note

• Because this can enable unauthorized command execution, you should treat patching as a priority comparable to taking the device’s integrity risk seriously, especially if any management or proxy-related functionality could be internet-reachable.

• Product/weakness: Fortinet FortiOS and FortiProxy contain an out-of-bounds write (CWE-787) that can lead to unauthorized code/command execution.
• Attack method: remote network access with no authentication and no user interaction, using specially crafted requests.
• Exploitation status: this is in CISA KEV and was used in ransomware campaigns, so exploitation is treated as confirmed.
• Fix availability (per provided patch info):
  • FortiProxy fixed in 2.0.14 (and also guidance for 7.4.3+, 7.2.9+, 7.0.15+).
  • FortiOS fixed in 6.0.18.
• Mitigation guidance: Fortinet PSIRT references FG-IR-24-015 and includes a compensating control to disable sslvpnd if needed.
• Exploit maturity/weaponization: public exploit details are not provided here, but the KEV inclusion and ransomware usage elevate risk from “theoretical” to “actively targeted.”