--- title: "FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762)" url: https://erroneo.us/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/ description: "Out-of-bounds write in FortiOS/FortiProxy sslvpnd allows unauthenticated RCE. Fixed in FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15 and others. In KEV. Act now." type: security-brief section: "Security Digest" date_published: 2024-02-08 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Act now" cves: ["CVE-2024-21762"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # FortiOS SSL VPN Pre-Auth RCE (CVE-2024-21762) **Verdict: Act now.** Any FortiGate or FortiProxy with SSL VPN enabled on an unfixed build is exposed to unauthenticated remote code execution that has been exploited; upgrade or disable SSL VPN today. - **Who must act:** Owners of FortiOS 6.0 through 7.4.2 or FortiProxy 1.0 through 7.4.2 devices with SSL VPN enabled, particularly where the VPN portal is internet-facing. - **Who can relax:** Devices already on fixed builds, and devices where SSL VPN is fully disabled (Fortinet's stated workaround); disabling only web mode does not count. - **Affected:** FortiOS 7.4.0-7.4.2; FortiOS 7.2.0-7.2.6; FortiOS 7.0.0-7.0.13; FortiOS 6.4.0-6.4.14; FortiOS 6.2.0-6.2.15; FortiOS 6.0.0-6.0.17; FortiProxy 7.4.0-7.4.2; FortiProxy 7.2.0-7.2.8; FortiProxy 7.0.0-7.0.14; FortiProxy 2.0.0-2.0.13; FortiProxy 1.2, 1.1, 1.0 (all versions) - **Fixed:** FortiOS 7.4.3; FortiOS 7.2.7; FortiOS 7.0.14; FortiOS 6.4.15; FortiOS 6.2.16; FortiOS 6.0.18; FortiProxy 7.4.3; FortiProxy 7.2.9; FortiProxy 7.0.15; FortiProxy 2.0.14; FortiProxy 1.x: migrate to a fixed release - **CVEs:** CVE-2024-21762 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Check the firmware version (`get system status` in the CLI or the dashboard) and upgrade to a fixed build using Fortinet's upgrade path tool. 2. If you cannot upgrade immediately, disable SSL VPN entirely; disabling web mode alone is not a valid workaround. 3. Apply the IPS signature HTTP.Chunk.Length.Invalid where FortiGuard virtual patching is available. 4. Move FortiProxy 1.x devices to a supported, fixed release. 5. If the device was exposed and unpatched, treat it as potentially compromised: review config and admin accounts, and rotate VPN and admin credentials. ### How to check if you are affected - Compare the running configuration against a known-good backup for new admin accounts, VPN users, policies or scripts. - Review logs for unexpected admin logins, crashes or restarts of the SSL VPN daemon, and unusual outbound connections from the device. - Hunt for lateral movement originating from the firewall's internal interfaces and from VPN-assigned addresses. ## What happened On February 8, 2024, Fortinet published [FG-IR-24-015](https://www.fortiguard.com/psirt/FG-IR-24-015), a critical out-of-bounds write (CWE-787) in `sslvpnd`, the SSL VPN daemon in FortiOS and FortiProxy. A remote, unauthenticated attacker can send specially crafted HTTP requests to execute arbitrary code or commands. Fortinet found it internally, scored it CVSS 9.8, and said the flaw was "potentially being exploited in the wild." One day later, on February 9, CISA [added it to the KEV catalog](https://www.cisa.gov/news-events/alerts/2024/02/09/cisa-adds-one-known-exploited-vulnerability-catalog), giving federal agencies until February 16 to fix it. Fortinet did not describe the root cause. On March 15, 2024, Searchlight Cyber's Assetnote team published a [patch analysis](https://www.slcyber.io/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762): the parser did not check the write offset when handling HTTP chunked trailers, so attacker-supplied trailers could write two bytes (`\r\n`) past a stack buffer. The researchers built a working pre-auth RCE against FortiGate 7.2.5, noting that their exploit was tailored to that exact build. ## Who is affected Per the advisory and the [NVD record](https://nvd.nist.gov/vuln/detail/CVE-2024-21762): | Product | Affected | Fixed | |---|---|---| | FortiOS 7.4 | 7.4.0-7.4.2 | 7.4.3 | | FortiOS 7.2 | 7.2.0-7.2.6 | 7.2.7 | | FortiOS 7.0 | 7.0.0-7.0.13 | 7.0.14 | | FortiOS 6.4 | 6.4.0-6.4.14 | 6.4.15 | | FortiOS 6.2 | 6.2.0-6.2.15 | 6.2.16 | | FortiOS 6.0 | 6.0.0-6.0.17 | 6.0.18 | | FortiProxy 7.4 / 7.2 / 7.0 / 2.0 | 7.4.0-7.4.2, 7.2.0-7.2.8, 7.0.0-7.0.14, 2.0.0-2.0.13 | 7.4.3, 7.2.9, 7.0.15, 2.0.14 | | FortiProxy 1.2 / 1.1 / 1.0 | All versions | Migrate to a fixed release | FortiOS 7.6 is not listed as affected. The exposure requires SSL VPN to be enabled. ## Do you really need to act? If SSL VPN is on and you are on an affected build, yes, today. This is the worst combination: an internet-facing service, no authentication, code execution on the device that sits at your network edge, and confirmed exploitation. The [KEV entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) still lists it as of October 21, 2026, and marks it as known to be used in ransomware campaigns. One inconsistency worth knowing: the advisory text says "potentially being exploited," while the page's structured "Known Exploited" field reads "No." CISA's KEV listing is the stronger signal; treat it as exploited. If SSL VPN is fully disabled, this specific bug is not reachable. Note that Fortinet explicitly says disabling web mode is not enough. ## What to do now 1. Check firmware with `get system status` and upgrade to a fixed build, using Fortinet's upgrade path tool to avoid unsupported jumps. 2. If you cannot upgrade now, disable SSL VPN completely. 3. Where FortiGuard virtual patching is in use, the IPS signature `HTTP.Chunk.Length.Invalid` (FMWP update 24.020) blocks the known pattern; it is a stopgap, not a fix. 4. Migrate FortiProxy 1.x devices, which have no fix on their branch. 5. If the device was exposed while vulnerable, assume possible compromise: review configuration and accounts, and rotate admin and VPN credentials. ## How to tell if you were hit Fortinet's advisory publishes no indicators of compromise, so detection is about consequences. Diff the running configuration against a known-good backup for new admin accounts, VPN users, firewall policies or scheduled scripts. Review logs for unexpected admin logins, SSL VPN daemon crashes or restarts, and outbound connections from the appliance. Hunt for lateral movement from the firewall's internal interfaces and VPN address pools. ## Timeline - Feb 8, 2024 — Fortinet publishes FG-IR-24-015 with fixed releases. - Feb 9, 2024 — CISA adds CVE-2024-21762 to KEV (due Feb 16). - Feb 23, 2024 — Fortinet adds further fixed versions to the advisory. - Mar 15, 2024 — Searchlight Cyber publishes root-cause analysis and a working exploit description. - Jan 15, 2025 — Fortinet adds IPS package information. - Oct 21, 2026 — Still in KEV with known ransomware use; brief updated. ## Sources 1. [Fortinet PSIRT — FG-IR-24-015: Out-of-bound Write in sslvpnd](https://www.fortiguard.com/psirt/FG-IR-24-015) 2. [NVD — CVE-2024-21762](https://nvd.nist.gov/vuln/detail/CVE-2024-21762) 3. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Feb 9, 2024)](https://www.cisa.gov/news-events/alerts/2024/02/09/cisa-adds-one-known-exploited-vulnerability-catalog) 4. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) 5. [Searchlight Cyber (Assetnote) — Two Bytes is Plenty: FortiGate RCE with CVE-2024-21762](https://www.slcyber.io/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762) --- Source page: https://erroneo.us/security/briefs/fortios-ssl-vpn-out-of-bounds-write-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt