topic Re: New Fortinet RCE flaw in SSL VPN likely exploited in attacks in Threats

New Fortinet RCE flaw in SSL VPN likely exploited in attacks

Kyaw_Myo_Oo — Sat, 10 Feb 2024 09:20:49 GMT

Dear all,

Fortinet is warning that a new critical remote code execution vulnerability in FortiOS SSL VPN is potentially being exploited in attacks.

The flaw (tracked as CVE-2024-21762 / FG-IR-24-015) received a 9.6 severity rating and is an out-of-bounds write vulnerability in FortiOS that allows unauthenticated attackers to gain remote code execution (RCE) via maliciously crafted requests.

New Fortinet RCE flaw in SSL VPN likely exploited in attacks (bleepingcomputer.com)

Re: New Fortinet RCE flaw in SSL VPN likely exploited in attacks

Early_Adopter — Sat, 10 Feb 2024 11:59:35 GMT

Ouch.

Big issue with these admittedly impressive multi-function god boxes is that it gets harder to cover everything. RCE is a real oversight.

Re: New Fortinet RCE flaw in SSL VPN likely exploited in attacks

Kyaw_Myo_Oo — Sat, 10 Feb 2024 15:02:16 GMT

Thanks for sharing your thoughts and views @Early_Adopter .