New Fortinet RCE flaw in SSL VPN likely exploited in attacks

Fortinet is warning that a new critical remote code execution vulnerability in FortiOS SSL VPN is potentially being exploited in attacks.

The flaw (tracked as CVE-2024-21762 / FG-IR-24-015) received a 9.6 severity rating and is an out-of-bounds write vulnerability in FortiOS that allows unauthenticated attackers to gain remote code execution (RCE) via maliciously crafted requests.

To patch the bug, Fortinet recommends upgrading to one of the latest version based on this table:

Version	Affected	Solution
FortiOS 7.6	Not affected	Not Applicable
FortiOS 7.4	7.4.0 through 7.4.2	Upgrade to 7.4.3 or above
FortiOS 7.2	7.2.0 through 7.2.6	Upgrade to 7.2.7 or above
FortiOS 7.0	7.0.0 through 7.0.13	Upgrade to 7.0.14 or above
FortiOS 6.4	6.4.0 through 6.4.14	Upgrade to 6.4.15 or above
FortiOS 6.2	6.2.0 through 6.2.15	Upgrade to 6.2.16 or above
FortiOS 6.0	6.0 all versions	Migrate to a fixed release

For those unable to apply patches, you can mitigate the flaw by disabling SSL VPN on your FortiOS devices.

Fortinet's advisory does not provide any details on how the vulnerability is being exploited or who discovered the vulnerability.

This flaw was disclosed today along with CVE-2024-23113 (Critical/9.8 rating), CVE-2023-44487 (Medium), and CVE-2023-47537 (Medium). However, these flaws are not marked as being exploited in the wild.

Threat actors commonly target Fortinet flaws to breach corporate networks for ransomware attacks and cyber espionage.

Yesterday, Fortinet disclosed that Chinese state-sponsored threat actors known as Volt Typhoon targeted FortiOS vulnerabilities to deploy custom malware known as COATHANGER.

This malware is a custom remote access trojan (RAT) designed to infect Fortigate network security appliances and was recently found used in attacks on the Dutch Ministry of Defence.

Due to the high severity of the newly disclosed CVE-2024-21762 flaw and the likelihood of it being exploited in attacks, it is strongly advised that you update your devices as soon as possible.