CVE-2024-21762

What it actually does

This is a remotely exploitable out-of-bounds write in Fortinet FortiOS and FortiProxy SSL-VPN handling. An unauthenticated attacker can send specially crafted network requests to a vulnerable exposed SSL-VPN service and corrupt memory in a way that can lead to arbitrary code or command execution on the appliance. Because the vulnerable service is commonly internet-facing and exploitation requires no credentials or user interaction, successful compromise can give the attacker control of the firewall or proxy, access to configuration and secrets, and a trusted foothold for lateral movement.

Why it matters to the business

Compromise of a Fortinet firewall or proxy can directly affect perimeter security, remote access, network segmentation, and business continuity. Attackers may steal VPN credentials, alter security policy, intercept or route traffic, disable protections, or use the device as an entry point for ransomware. This issue is listed in CISA KEV, has known active exploitation, is associated with ransomware activity including Qilin, BianLian, RansomExx, DragonForce, and Play campaigns, and had a CISA remediation due date of 2024-02-16, so any remaining exposure should be treated as an emergency remediation and incident-response priority.

How an attack unfolds

An attacker first identifies internet-exposed FortiOS or FortiProxy SSL-VPN services and fingerprints their versions or behavior. The attacker then sends crafted requests to the SSL-VPN interface that trigger the out-of-bounds write condition. If exploitation succeeds, memory corruption allows unauthorized code or command execution in the context of the affected appliance process. From there, the attacker can attempt to establish persistence, collect device configuration, retrieve credentials or session material, create or modify accounts and policies, disable logging or protections, and pivot through trusted VPN or network paths. In observed threat activity, compromised edge devices are commonly used as stealthy initial access for data theft and ransomware deployment.

How to fix it

Upgrade affected Fortinet appliances immediately using Fortinet-supported fixed releases. For FortiOS, upgrade 7.4.0-7.4.2 to 7.4.3 or later, 7.2.0-7.2.6 to 7.2.7 or later, and 7.0.0-7.0.13 to 7.0.14 or later; older affected branches such as 6.4.x, 6.2.x, and 6.0.x should be migrated to a supported fixed branch. For FortiProxy, upgrade 7.4.0-7.4.2 to 7.4.3 or later, 7.2.0-7.2.8 to 7.2.9 or later, and 7.0.0-7.0.14 to 7.0.15 or later; older affected FortiProxy branches should be migrated to a supported fixed branch. If immediate upgrade is not possible, disable SSL-VPN entirely until patched; restricting access by source IP, placing the device behind additional controls, and monitoring can reduce exposure but should not be treated as complete remediation. After patching, rotate local and remote-access credentials, review administrative accounts, inspect configuration changes, revoke suspicious sessions, and verify that logging remains enabled. The Mattermost package references in the supplied data are inconsistent with this Fortinet vulnerability and should not be used as the basis for remediating this issue.

How to confirm the fix worked

Confirm the running FortiOS or FortiProxy version from the appliance management interface or CLI and verify it is at or above the applicable fixed release. Independently validate external exposure by scanning known internet-facing addresses for Fortinet SSL-VPN services and confirming that no vulnerable version remains reachable. Where SSL-VPN was used as a workaround, verify that the service is actually disabled rather than only partially restricted. Review Fortinet PSIRT advisory guidance, upgrade logs, and configuration backups to confirm the patch was applied successfully and persisted after reboot or failover. Run authenticated vulnerability scanning where possible, and compare results against asset inventory so clustered, standby, lab, and disaster-recovery appliances are not missed.

Typical attack path

1. Scan the internet or target ranges for exposed Fortinet SSL-VPN or FortiProxy services.
2. Fingerprint the appliance and identify versions consistent with vulnerable FortiOS or FortiProxy releases.
3. Send specially crafted unauthenticated requests to the SSL-VPN service to trigger memory corruption.
4. Gain unauthorized code or command execution on the appliance if exploitation is successful.
5. Dump configuration, users, VPN settings, certificates, tokens, or other secrets available on the device.
6. Modify firewall, proxy, VPN, or administrative settings to maintain access or weaken defenses.
7. Use the compromised appliance as a trusted foothold to access internal systems.
8. Conduct credential theft, data exfiltration, lateral movement, and potentially ransomware deployment.

How to detect it

Investigate FortiGate and FortiProxy system event logs, VPN event logs, administrative audit logs, crash logs, configuration change history, HA/failover events, and upstream firewall or NetFlow records. Look for unexplained sslvpnd crashes or restarts, segmentation faults, device reboots, spikes of malformed HTTPS requests to SSL-VPN paths, unauthenticated requests immediately preceding process crashes, new or modified administrator accounts, unexpected VPN users or portals, altered firewall or proxy policy, changed logging settings, and unexplained outbound connections from the appliance. Review authentication telemetry for successful logins from unusual geographies, impossible travel, new user agents, or source IPs that previously generated SSL-VPN errors. Because exploitation may leave limited application-layer evidence, correlate appliance crash timestamps with edge network traffic, IPS alerts, configuration diffs, and downstream signs of intrusion such as internal scanning, credential misuse, data staging, and ransomware tooling. In environments with threat-intelligence enrichment, prioritize searches for activity associated with ransomware campaigns reported to exploit this vulnerability, including Qilin, BianLian, RansomExx, DragonForce, Play, and StrikeShark-related infrastructure where available.

• sslvpnd
• SSL-VPN
• signal 11
• segmentation fault
• crashlog
• /remote/login
• /remote/portal
• /remote/hostcheck_validate
• /remote/fgt_lang
• FortiGate.SSL.VPN.Out.Of.Bounds.Write
• FortiOS.SSL.VPN.Out.Of.Bounds.Write
• FG-IR-24-015

What your security team should do

• Treat any vulnerable or recently vulnerable internet-facing FortiOS or FortiProxy SSL-VPN appliance as potentially compromised and begin incident-response triage, not just patching.
• Patch or migrate all affected FortiOS and FortiProxy versions immediately; if patching cannot be completed at once, disable SSL-VPN until remediation is complete.
• Prioritize externally exposed appliances, high-availability peers, managed service edge devices, and systems protecting sensitive network segments.
• Review appliance logs, crash logs, admin audit logs, VPN logs, configuration revision history, and upstream network telemetry for exploitation or post-exploitation activity.
• Rotate administrator credentials, VPN credentials, API tokens, certificates, and shared secrets that could have been accessible from the appliance.
• Hunt for newly created or modified admin accounts, unexpected local users, unauthorized firewall or VPN policy changes, disabled logging, and unfamiliar scheduled or automation tasks.
• Check for unusual outbound connections from the appliance to internet infrastructure, especially after SSL-VPN crashes or unexpected restarts.
• Apply Fortinet IPS and threat-intelligence signatures where available, but do not rely on signatures as a substitute for upgrading.
• Increase monitoring for ransomware precursors such as mass authentication attempts, remote-access anomalies, internal reconnaissance, credential dumping, data staging, and backup tampering.
• Document remediation evidence because this vulnerability is in CISA KEV, associated with ransomware activity, and the federal remediation deadline has already passed.