Skip to content
VULNERABILITY
FortiOS – Critical Vulnerability on Out-of-bound Write in sslvpnd [CVE-2024-21762]
An out-of-bounds write vulnerability [CWE-787] in FortiOS. This may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests.
Resource link: https://www.fortiguard.com/psirt/FG-IR-24-015?s=09
Workaround : disable SSL VPN (disable webmode is NOT a valid workaround)
Note: This is potentially being exploited in the wild.
Please review the scope of work below prior to authorizing NCI to remediate.
Scope of work:
Download and install the latest cumulative updates for your current affected version of FortiOS / FortiProxy for up to 4 devices. A restart will be required in order to complete the remediation (estimated 1 hour of downtime).
Version:
FortiOS 7.6
FortiOS 7.4
FortiOS 7.2
FortiOS 7.0
FortiOS 6.4
FortiOS 6.2
FortiOS 6.0
FortiOS 7.4
FortiOS 7.2
FortiOS 7.0
FortiOS 2.0
FortiOS 1.2
FortiOS 1.1
FortiOS 1.0
Affected:
Not affected
7.4.0 through 7.4.2
7.2.0 through 7.2.6
7.0.0 through 7.0.13
6.4.0 through 6.4.14
6.2.0 through 6.2.15
6.0 all versions
7.4.0 through 7.4.2
7.2.0 through 7.2.8
7.0.0 through 7.0.14
2.0.0 through 2.0.13
1.2 all versions
1.1 all versions
1.0 all versions
Solution:
Not Applicable
Upgrade to 7.4.3 or above
Upgrade to 7.2.7 or above
Upgrade to 7.0.14 or above
Upgrade to 6.4.15 or above
Upgrade to 6.2.16 or above
Migrate to a fixed release
Upgrade to 7.4.3 or above
Upgrade to 7.2.9 or above
Upgrade to 7.0.15 or above
Upgrade to 2.0.14 or above
Migrate to a fixed release
Migrate to a fixed release
Migrate to a fixed release
Remediation and updates have the potential to cause other unforeseen issues or conflicts between software and/or hardware. If additional work is needed to get all systems and software to acceptable levels due to compatibility issues or conflicts, the time associated will be billed at time and materials.
If you would like to schedule the remediation work outside of your business hours please have the point of contact in your support ticket communicate with our scheduling team so we can accommodate.
By completing the following form, you agree to the scope of work and remediation estimate.
The form you are trying to access is now closed.
To submit a remediation request for FortiOS – Critical Vulnerability on Out-of-bound Write in sslvpnd, please navigate to our Contact Us form. In your message, be sure to include the name of the vulnerability and specify that it is a remediation request.
We appreciate your understanding and look forward to assisting you with your request.
