Fortinet FortiGate < 7.2.5 — RCE

Full unauthenticated code execution on the FortiGate firewall. An attacker can read VPN credentials, modify firewall rules, install backdoors, and pivot to the internal network through the device that is protecting it. This class of vulnerability has been used by ransomware groups to gain initial access to enterprise networks.

The SSL-VPN web management portal in FortiOS fails to validate memory bounds when processing certain HTTP requests. An unauthenticated attacker can send a crafted HTTP packet that overflows the heap, overwriting function pointers and achieving code execution on the FortiGate device. The exploit works against the internet-facing VPN portal.

Probably yes if any of these apply:

Mandiant identified exploitation of FortiOS SSL-VPN zero-days by a suspected China-linked actor (UNC3886) in June 2023. The group deployed custom malware (BOLDMOVE) on compromised FortiGate devices. CISA and FBI issued a joint advisory recommending immediate patching. Over 250,000 FortiGate devices were estimated to have internet-exposed SSL-VPN portals at the time of disclosure.