Fortinet FortiGate < 7.4.3 — RCE
An out-of-bounds write in FortiOS SSL-VPN allows unauthenticated RCE. Upgrade to FortiOS 7.4.3 / 7.2.7 / 7.0.14 or disable SSL-VPN — CISA confirmed active exploitation in February 2024.
Unauthenticated code execution on the FortiGate device as root, enabling full network access, credential theft, and persistent backdoor installation inside the perimeter.
FortiOS has an out-of-bounds write vulnerability in its SSL-VPN component. An unauthenticated attacker can send crafted HTTP requests that write outside the bounds of an allocated buffer, allowing arbitrary code execution on the device.
📧
Phishing link
🖼
Malicious file
🔓
Server compromised
Probably yes if any of these apply:
CISA added CVE-2024-21762 to the Known Exploited Vulnerabilities catalog on February 9, 2024. The US government issued an alert noting that over 150,000 FortiGate devices were exposed to the internet and potentially vulnerable. Exploitation was observed across multiple sectors including healthcare, finance, and critical infrastructure.
Manual remediation steps
⏱ 30 minutes including restartCheck Version and Exposure
# CLI:
get system status
# Check if SSL-VPN is enabled (exploitable surface):
get vpn ssl settings | grep status
# If "status: enable" — SSL-VPN is active and exposed
Disable SSL-VPN as Immediate Mitigation
config vpn ssl settings
set status disable
end
Upgrade FortiOS
Verify
get system status
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References