133,000+ Vulnerable FortiOS/FortiProxy Instances : Exploitation Started

A serious security vulnerability has been identified in Fortinet’s FortiOS and FortiProxy, potentially affecting over 133,000 devices worldwide.

The flaw, tracked as CVE-2024-21762, is an out-of-bounds write vulnerability that will per chance well well allow a far-off, unauthenticated attacker to fabricate arbitrary code or commands thru specifically crafted HTTP requests.

CVE-2024-21762: A Critical Out-of-Bounds Write Vulnerability

The vulnerability has been assigned a Long-established Vulnerability Scoring Plot (CVSS) get of 9.6, indicating its serious severity.

Fortinet has acknowledged that CVE-2024-21762 is “potentially being exploited in the wild,” urging customers to coach the foremost updates to mitigate the probability.

Fortiguard has identified an out-of-bounds write vulnerability [CWE-787] in FortiOS and FortiProxy.

A far-off attacker can exploit this vulnerability without authentication, utilizing specifically crafted HTTP requests.

As a consequence, the attacker can manufacture arbitrary code or commands on the vulnerable instrument.

In step with a most up-to-date tweet from ShadowServer, Fortinet is tranquil vulnerable to assaults, with over 133,000 cases in possibility.

This suggests that improper actors could per chance well well exploit a potentially huge assault floor.

Affected Versions and Solutions

The affected versions of FortiOS and FortiProxy, along with the instructed choices, are as follows:

• FortiOS 7.4: Versions 7.4.0 thru 7.4.2 ought to tranquil be upgraded to 7.4.3 or above.
• FortiOS 7.2: Versions 7.2.0 thru 7.2.6 ought to tranquil be upgraded to 7.2.7 or above.
• FortiOS 7.0: Versions 7.0.0 thru 7.0.13 ought to tranquil be upgraded to 7.0.14 or above.
• FortiOS 6.4: Versions 6.4.0 thru 6.4.14 ought to tranquil be upgraded to 6.4.15 or above.
• FortiOS 6.2: Versions 6.2.0 thru 6.2.15 ought to tranquil be upgraded to 6.2.16 or above.
• FortiOS 6.0: Versions 6.0.0 thru 6.0.17 ought to tranquil be upgraded to 6.0.18 or above.
• FortiProxy 7.4: Versions 7.4.0 thru 7.4.2 ought to tranquil be upgraded to 7.4.3 or above.
• FortiProxy 7.2: Versions 7.2.0 thru 7.2.8 ought to tranquil be upgraded to 7.2.9 or above.
• FortiProxy 7.0: Versions 7.0.0 thru 7.0.14 ought to tranquil be upgraded to 7.0.15 or above.
• FortiProxy 2.0: Versions 2.0.0 thru 2.0.13 ought to tranquil be upgraded to 2.0.14 or above.
• FortiProxy 1.2, 1.1, and 1.0: All versions ought to tranquil migrate to a mounted unencumber.

Customers can verbalize the instructed upgrade course utilizing Fortinet’s upgrade instrument.

As a fast measure, Fortinet advises disabling the SSL VPN feature, noting that simply disabling web mode is no longer a sound workaround.

Exploitation and Impact

The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that CVE-2024-21762 has been exploited by adding it to its Identified Exploited Vulnerabilities Catalog.

The vulnerability has been exploited by attackers actively seeking to compromise devices which possess no longer but been patched.

Most doable targets are in the USA, India, Brazil, and Canada.

The urgency to patch the vulnerability is underscored by the high CVSS get and the ease of exploitation, which would perhaps per chance well well grant attackers entry to sensitive data.

Absorb up up to now on Cybersecurity data, Whitepapers, and Infographics. Apply us on LinkedIn & Twitter.