CVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability
Description
CVE-2024-21762 is a critical out-of-bounds write vulnerability (CWE-787) in Fortinet FortiOS and FortiProxy that allows unauthenticated remote attackers to execute arbitrary code or commands via specially crafted HTTP requests. The vulnerability affects FortiOS versions 6.0.0 through 7.4.2 and FortiProxy versions 1.0.0 through 7.4.2, making it one of the broadest Fortinet advisories in recent history. CISA has confirmed active exploitation and added CVE-2024-21762 to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 16, 2024, and ransomware operators have been documented exploiting this flaw. With a CVSS score of 9.8 (CRITICAL) and an EPSS score of 92.9% (99.8th percentile), CVE-2024-21762 represents an immediate, high-severity threat to any organization running unpatched Fortinet network infrastructure.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 1.0.0, < 2.0.14; >= 7.0.0, < 7.0.15; >= 7.2.0, < 7.2.9; >= 7.4.0, < 7.4.3 |
| fortinet | fortios | >= 6.0.0, < 6.0.18; >= 6.2.0, < 6.2.16; >= 6.4.0, < 6.4.15; >= 7.0.0, < 7.0.14; >= 7.2.0, < 7.2.7; >= 7.4.0, < 7.4.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-24-015(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CWE-787 describes a weakness where software writes data past the end, or before the beginning, of an intended buffer, leading to memory corruption that can enable arbitrary code execution, crashes, or other undefined behavior. In CVE-2024-21762, Fortinet FortiOS and FortiProxy contain an out-of-bounds write condition triggered by specially crafted network requests, allowing an unauthenticated remote attacker to corrupt memory and execute unauthorized code with the privileges of the affected service.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2024-21762 carries the maximum practical CVSS score of 9.8 (CRITICAL) and is fully remotely exploitable with no authentication required and no user interaction needed — an attacker need only send a crafted request to an exposed FortiOS or FortiProxy interface. Confidentiality (High): Complete compromise of all data accessible to the vulnerable process is possible, including VPN credentials, network configurations, and security policy data. Integrity (High): Attackers can modify system configuration, install backdoors, or alter network traffic routing — particularly dangerous given FortiOS's role as a network perimeter device. Availability (High): The out-of-bounds write can crash the affected service or render the device inoperable, disrupting VPN access, firewall enforcement, and network connectivity for entire organizations. The combination of CISA KEV confirmation, ransomware usage, and a 99.8th percentile EPSS score makes CVE-2024-21762 a critical-priority vulnerability requiring immediate emergency patching.
Exploit Maturity
CVE-2024-21762 is actively exploited in the wild, confirmed by CISA in the Known Exploited Vulnerabilities catalog with an emergency remediation deadline of February 16, 2024. Ransomware operators have been documented exploiting this vulnerability against Fortinet FortiOS and FortiProxy deployments, making it one of the most dangerous active threats for network perimeter infrastructure. The EPSS score of 92.9% (99.8th percentile) reflects near-certain exploitation activity, consistent with the real-world observation of mass scanning and exploitation of Fortinet devices following public disclosure. The Fortinet PSIRT advisory at https://fortiguard.com/psirt/FG-IR-24-015 provides official details, and the vulnerability's unauthenticated, zero-interaction exploitation profile makes it trivially wieldable by automated attack tools.
Remediation
- Apply Fortinet security patches immediately per the vendor advisory at https://fortiguard.com/psirt/FG-IR-24-015 — this is CISA's required action with a deadline of February 16, 2024.
- Upgrade FortiOS to a fixed version: 7.4.3 or later (for 7.4.x), 7.2.7 or later (for 7.2.x), 7.0.14 or later (for 7.0.x), 6.4.15 or later (for 6.4.x), 6.2.16 or later (for 6.2.x). For FortiProxy, upgrade to 7.4.3+, 7.2.9+, 7.0.15+, or 2.0.14+ per the applicable branch.
- If immediate patching is not possible, disable the SSL VPN interface as a temporary mitigation per Fortinet guidance, or restrict access to the management interface to trusted IP ranges only.
- Review FortiOS logs for anomalous requests, unexpected configuration changes, or signs of post-exploitation activity such as new administrative accounts or unusual outbound connections.
- After patching, audit all administrative credentials and API keys on FortiOS/FortiProxy devices, as exploitation may have enabled credential harvesting or backdoor installation prior to remediation.
Technical Details
CVE-2024-21762 is caused by an out-of-bounds write condition (CWE-787) in the FortiOS and FortiProxy SSL-VPN web management interface, triggered by a specially crafted HTTP or HTTPS request. When the vulnerable code processes request data exceeding the expected buffer boundaries, it writes to adjacent memory regions, corrupting heap or stack structures in a way that can redirect execution flow to attacker-controlled code. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that no authentication, no special conditions, and no user interaction are required — the attack can be launched remotely against any reachable FortiOS or FortiProxy interface. The breadth of affected versions (FortiOS 6.0 through 7.4 and FortiProxy 1.0 through 7.4) indicates a systemic flaw in shared code across the Fortinet product line, requiring broad remediation across the entire installed base.
Frequently Asked Questions
Is CVE-2024-21762 being actively exploited?
Yes. CVE-2024-21762 is confirmed as actively exploited in the wild by CISA, with a remediation deadline of February 16, 2024. Ransomware groups have been documented exploiting this vulnerability against Fortinet FortiOS and FortiProxy devices, and the 99.8th percentile EPSS score confirms extremely high real-world exploitation activity.
What products are affected by CVE-2024-21762?
CVE-2024-21762 affects Fortinet FortiOS versions 6.0.0 through 7.4.2 and Fortinet FortiProxy versions 1.0.0 through 7.4.2 across multiple minor version branches. Given the extensive version range, virtually all organizations using Fortinet FortiOS or FortiProxy without recent patches should assume they are vulnerable.
How do I fix CVE-2024-21762?
Apply Fortinet's official patches immediately as detailed in the PSIRT advisory at https://fortiguard.com/psirt/FG-IR-24-015. If patching cannot be done immediately, disable the SSL VPN interface per Fortinet guidance as a temporary mitigation. See the Remediation section for version-specific upgrade targets and post-patch hardening steps.
How severe is CVE-2024-21762?
CVE-2024-21762 is rated CRITICAL with a CVSS score of 9.8 — the highest practical severity level. Its EPSS score of 92.9% (99.8th percentile) reflects near-certain real-world exploitation, and ransomware usage has been confirmed. This vulnerability should be treated as an emergency requiring immediate action for all affected Fortinet environments.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.