Vulnerability in 150K+ Fortinet Devices Let Hackers Execute Arbitary Code Remotely

A serious security flaw acknowledged as CVE-2024-21762 has been found in Fortinet’s FortiOS and FortiProxy stable net gateway methods, potentially impacting around 150,000 devices worldwide.

The vulnerability permits for unauthenticated faraway code execution (RCE) by sending specially crafted HTTP requests to the affected machines.

The U.S. Cybersecurity and Infrastructure Safety Agency (CISA) has confirmed that attackers actively exploit the flaw, alongside with it to its Identified Exploited Vulnerabilities (KEV) catalog.

Federal Civilian Govt Department (FCEB) agencies must notice the fixes by February 16, 2024, to stable their networks in opposition to doubtless threats.

CVE-2024-21762 – Units Affected

The vulnerability affects a spacious assortment of Fortinet’s security house equipment, alongside with variations of FortiOS, FortiProxy, FortiSwitchManager, and FortiAnalyzer.

These devices are often extinct by organizations to maintain a watch on community security, making the flaw notably touching on because it may perchance perchance grant sensitive details discover entry to.

In step with the FortiGuard Labs’ security advisory, the vulnerability is the pause consequence of an obnoxious limitation of a pathname to a restricted itemizing, which shall be exploited by an unauthenticated attacker by capability of the accumulate.

This may perchance well well also lead to arbitrary code execution on the underlying working machine of affected devices.

Exploitation of this vulnerability has been reported within the wild, with attackers actively seeking out to compromise devices which maintain no longer but been patched.

The flaw’s severity has been underscored by its high CVSS obtain, which displays the benefit of exploitation and the capability impact on affected methods.

As per the Shadowserver legend, more than 150,000 devices maintain been acknowledged as susceptible.

Fortinet has launched patches for the affected variations and is urging possibilities to change their devices straight to mitigate the chance. The affected variations and the corresponding patches shall be found on Fortinet’s reputable advisory net page.

BishopFox has made a compare script readily available on GitHub for customers and administrators who are doubtful if their devices are susceptible. The script, CVE-2024-21762-compare, shall be extinct to search out out if a Fortinet tool is inclined to the flaw, facilitating a more efficient response to the threat.

Observe the advised upgrade steerage.

• Fixed with mounted variations equipped and availability of Fortinet instrument at https://docs.fortinet.com/upgrade-instrument)
• Disable SSL VPN (disable webmode is NOT a legit workaround) unless the upgrade shall be performed.

Discontinuance up as a lot as now on Cybersecurity details, Whitepapers, and Infographics. Observe us on LinkedIn & Twitter.