Fortinet Releases High-Risk Security Vulnerability in FortiOS SSL VPNs

background:

Fortinet Headquartered in Sunnyvale, California, Fortinet has been leading the way for more than two decades.cyber security行业创新发展，持续推动网络与安全融合。我们的使命是保护任何位置的人、设备和数据的安全,构建可信任的数字世界。为此，我们 50 余款企业级网络安全产品，是目前业内最广泛、集成的解决方案组合，可在您需要的任意位置，构建经验证的数字安全。凭借全行业最多专利及权威机构认证数量，Fortinet安全解决方案深受全球用户信赖，全球用户数量超 68 万，是业内解决方案部署数量最多的安全厂商。

Fortinet disclosed theFortiOS SSL VPNa new critical security vulnerability that has been reported as possibly having been exploited in the wild.

Vulnerability Details

Vulnerability Number:CVE-2024-21762

CVSS Score: 9.6 Detailed Description:An out-of-bounds write vulnerability [CWE-787] has been identified in FortiOS, which could allow remote, unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests.

Affected versions

The FortiOS versions affected by this vulnerability are listed below; notably, FortiOS 7.6 is not affected.

FortiOS 7.4 (versions 7.4.0 to 7.4.2) - upgrade to 7.4.3 or above
FortiOS 7.2 (versions 7.2.0 through 7.2.6) - upgrade to 7.2.7 or above
FortiOS 7.0 (versions 7.0.0 to 7.0.13) - upgrade to 7.0.14 or above
FortiOS 6.4 (versions 6.4.0 through 6.4.14) - upgrade to 6.4.15 or above
FortiOS 6.2 (versions 6.2.0 through 6.2.15) - upgrade to 6.2.16 or above
FortiOS 6.0 (all 6.0 versions) - Migrate to fixed version

security update

Fortinet has also released a program forCVE-2024-23108andCVE-2024-23109patches for vulnerabilities that affectFortiSIEMSupervisor, which allows remote unauthenticated attackers to execute unauthorized commands via specially crafted API requests.Fortinet reports that N-day security vulnerabilities in its software such as CVE-2022-42475 and CVE-2023-27997 are being exploited by different groups of activists to target various organizations.

Vulnerability Confirmation:

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-21762 to its Known Exploited Vulnerabilities (KEV) catalog on February 9, 2024, providing evidence of active exploitation in the wild.

Response

All Federal Civilian Executive Bodies (FCEBs) are required to apply fixes by February 16, 2024 to prevent potential threats.

This security snapshot highlights the growing threat to network edge devices due to a lack of Endpoint Detection and Response (EDR) support, especially against the backdrop of a tense global cybersecurity landscape. Organizations need to respond quickly to ensure cybersecurity.