CVE-2024-21762
CRITICAL · 9.8 KEV EPSS 84.3%KEV-listed, in-the-wild 3BB breach documented, ransomware gang weaponization, defender triage underway.
What: Out-of-bounds write in Fortinet FortiOS and FortiProxy SSL VPN (versions 6.0–7.4) enabling unauthenticated remote code execution; CVSS 9.8 CRITICAL, EPSS 84.3%.
Why it matters: KEV-listed on day of publication (2024-02-09); confirmed in-the-wild exploitation documented against Thai ISP 3BB with MeshCentral backdoor deployment; actively exploited by multiple threat actors including Qilin ransomware gang using it for initial access; defenders triaging mass VPN exposure across customer base.
Where it's seen: Security researchers and threat intel vendors posting exploitation timelines and IOCs; ransomware playbook references; incident reports linking 3BB breach to active toolkit deployment; patching urgency emphasized by CISO-facing threat feeds.
RISK: CRITICAL — Unauthenticated RCE, CVSS 9.8, widespread VPN deployment, active exploitation confirmed.
Description
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected versions
- fortinet/fortiproxy
- 1.0.0 – < 2.0.14
- 7.0.0 – < 7.0.15
- 7.2.0 – < 7.2.9
- 7.4.0 – < 7.4.3
- fortinet/fortios
- 6.0.0 – < 6.0.18
- 6.2.0 – < 6.2.16
- 6.4.0 – < 6.4.15
- 7.0.0 – < 7.0.14
- 7.2.0 – < 7.2.7
- 7.4.0 – < 7.4.3