CyberCVE

CVE-2024-21762

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions

Severity
Critical 9.6
CVSS 3.1
Exploited
Yes — in CISA KEV
Added Feb 9, 2024 · known ransomware use
EPSS
0.834
99.7th percentile
Discovered by
Vendor
Vendor advisory field
Published
Feb 9, 2024
Assigned by fortinet

Description

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests

Weakness: CWE-787

Affected products

Vendor Product Category Matched by
Fortinet FortiOS Firewall / NGFW cna-assigner
Fortinet FortiProxy SASE / SSE / Secure Web cna-assigner
Vendor-reported products (11)
  • Fortinet · FortiProxy
  • Fortinet · FortiOS
  • fortinet · fortiproxy
  • fortinet · fortiproxy
  • fortinet · fortiproxy
  • fortinet · fortiproxy
  • fortinet · fortios
  • fortinet · fortios
  • fortinet · fortios
  • fortinet · fortios
  • fortinet · fortios

Credit

Internal

Vendor remediation

Please upgrade to FortiProxy version 7.4.3 or above Please upgrade to FortiProxy version 7.2.9 or above Please upgrade to FortiProxy version 7.0.15 or above Please upgrade to FortiProxy version 2.0.14 or above Please upgrade to FortiOS version 7.6.0 or above Please upgrade to FortiOS version 7.4.3 or above Please upgrade to FortiOS version 7.2.7 or above Please upgrade to FortiOS version 7.0.14 or above Please upgrade to FortiOS version 6.4.15 or above Please upgrade to FortiOS version 6.2.16 or above

References

Something wrong here?