CVE-2024-21762criticalunder attackransomwareCWE-787

CVE-2024-21762: critical vulnerability in Fortinet FortiOS

Published · Updated

Follow this CVE+ Monitor FortiOS+ Monitor FortiProxy

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a public proof of concept.

ssvc Actcvss 9.6epss 85%
from disclosure to weapon19 days
Published on NVDFeb 9
1st PoC+19d
CISA KEVFeb 9
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-02-16

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A memory writing flaw in Fortinet FortiOS and FortiProxy allows attackers to write data beyond intended memory boundaries through specially crafted requests, potentially enabling them to run unauthorized code on affected devices.

Technical detail

Out-of-bounds write vulnerability (CWE-787) in FortiOS 6.0.0–7.4.2 and FortiProxy 1.0.0–7.4.2 permits remote code execution when processing specially crafted requests; no authentication requirement specified, indicating network-accessible attack vector with critical impact on system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:C
Affected products
Fortinet · FortiOSFortinet · FortiProxy
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Fortinet FortiOS

In the same product, most dangerous first.

CVE-2022-42475CRITICALCVE-2022-42475EPSS 99.5%KEVCVE-2024-55591CRITICALCVE-2024-55591EPSS 94.3%KEVCVE-2023-27997CRITICALCVE-2023-27997EPSS 86.8%KEVCVE-2026-24858CRITICALCVE-2026-24858EPSS 86.6%KEVCVE-2025-59718CRITICALCVE-2025-59718EPSS 68.1%KEVCVE-2024-23113CRITICALCVE-2024-23113EPSS 61.7%KEV