Fortinet Patches Two Critical FortiOS and FortiProxy RCE Vulnerabilities
Summary
Two critical FortiOS and FortiProxy flaws could allow unauthenticated remote code execution. CVE-2024-21762 is reportedly exploited in the wild; the article lists affected versions, fixes, and workarounds.
Key points
- CVE-2024-21762 (CVSS 9.6) affects FortiOS SSL-VPN and involves improper parameter validation that can cause memory corruption.
- CVE-2024-23113 (CVSS 9.8) is a format string flaw in the FortiOS fgfmd daemon; it affects more recent product versions.
- Both flaws could let a remote unauthenticated attacker execute arbitrary code or commands.
- Fortinet says CVE-2024-21762 is potentially being exploited in the wild; CISA added it to its Known Exploited Vulnerabilities catalog.
- The article lists affected FortiOS, FortiProxy, and FortiPAM versions and recommends upgrading to fixed releases.
- If patching is not possible, the suggested workarounds are disabling SSL VPN for CVE-2024-21762 and removing FGFM access on each interface for CVE-2024-23113.
Article Details
- Vulnerability Types
- Improper parameter validation leading to out-of-bounds copying and memory corruption
- Format string vulnerability
- Severity
- Critical; CVSS 9.6 for CVE-2024-21762 and 9.8 for CVE-2024-23113
- Affected Versions
- FortiOS 7.4.0 through 7.4.2
- FortiOS 7.2.0 through 7.2.6
- FortiOS 7.0.0 through 7.0.13
- FortiOS 6.4.0 through 6.4.14
- FortiOS 6.2.0 through 6.2.15
- FortiOS 6.0 all versions
- FortiProxy 7.4.0 through 7.4.2
- FortiProxy 7.2.0 through 7.2.8
- FortiProxy 7.0.0 through 7.0.14
- FortiProxy 2.0.0 through 2.0.13
- FortiProxy 1.2 all versions
- FortiProxy 1.1 all versions
- FortiProxy 1.0 all versions
- FortiPAM 1.2.0
- FortiPAM 1.1.0 through 1.1.2
- FortiPAM 1.0 all versions
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For CVE-2024-21762, disable SSL VPN if unable to patch.
- For CVE-2024-23113, remove FGFM access for each interface if unable to patch; this prevents FortiGate discovery from FortiManager, while connections from the FortiGate still work.
MITRE ATT&CK
CVE
CVE-2024-21762CVE-2024-21762 and CVE-2024-23113 are critical vulnerabilities in Fortinet's FortiOS and FortiProxy; they received a CVSS score of 9.6 and 9.8, respectively.CVE-2024-23113CVE-2024-21762 and CVE-2024-23113 are critical vulnerabilities in Fortinet's FortiOS and FortiProxy; they received a CVSS score of 9.6 and 9.8, respectively.
Vendors
Products
FortiManagerfor each interface, as described in Fortinet's advisory (this will prevent FortiGate discovery from FortiManager, but connections from the FortiGate will still work). Fortinet FortiGateby removing FGFM access for each interface, as described in Fortinet's advisory (this will prevent FortiGate discovery from FortiManager, but connections from the FortiGate will still work). FortiOSCVE-2024-21762 and CVE-2024-23113 are critical vulnerabilities in Fortinet's FortiOS and FortiProxy; they received a CVSS score of 9.6 and 9.8, respectively.FortiPAMFortiPAM 1.2 1.2.0 Upgrade to 1.2.1 or aboveFortiProxyCVE-2024-21762 and CVE-2024-23113 are critical vulnerabilities in Fortinet's FortiOS and FortiProxy; they received a CVSS score of 9.6 and 9.8, respectively.