CVE-2024-21762 is a critical out-of-bounds write vulnerability affecting multiple versions of Fortinet FortiOS and FortiProxy. This flaw allows unauthenticated attackers to execute arbitrary code or commands remotely through specially crafted requests. With a CVSS score of 9.8 (Critical) and an EPSS score indicating high exploitability, the vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and complete compromise potential. It is actively exploited in the wild, notably by the Qilin ransomware group, and has garnered extensive community discussion and media coverage, despite no public exploit code being available in Metasploit, Nuclei, or ExploitDB.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.0.0, < 2.0.14CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 7.0.0, < 7.0.15CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 7.2.0, < 7.2.9CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 7.4.0, < 7.4.3CPE matchmatch criteria | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | ||
>= 6.0.0, < 6.0.18CPE matchmatch criteria | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.