FortiOS / FortiProxy SSL VPN CVE-2024-21762 (out-of-bounds write, unauthenticated RCE, CISA KEV, FG-IR-24-015): which versions are fixed and is disabling web mode enough?

What it is: CVE-2024-21762 is an out-of-bounds write in the SSL VPN daemon (sslvpnd) of Fortinet FortiOS and FortiProxy, disclosed in February 2024. A remote attacker with no credentials can send crafted HTTP requests and run code on the firewall. Fortinet warned it was potentially exploited in the wild, CISA added it to the KEV catalog, and Fortinet SSL VPNs remain one of the most scanned edge devices, so old appliances that missed this update are still at risk. Am I affected: - FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15, 6.0.0-6.0.17 with SSL VPN enabled. - FortiProxy 7.4.0-7.4.2, 7.2.0-7.2.8, 7.0.0-7.0.14, 2.0.0-2.0.13, and all of 1.0/1.1/1.2 (no fix on those). - Check with get system status on the CLI (or the dashboard), and whether SSL VPN is enabled (config vpn ssl settings). Fix: 1. Upgrade to at least FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16 or 6.0.18, or FortiProxy 7.4.3, 7.2.9, 7.0.15 or 2.0.14. Today, prefer the latest release on a supported branch, since later SSL VPN bugs were fixed too; 6.x branches are end-of-life. 2. If you can't upgrade right away, disable SSL VPN. Fortinet states that disabling only web mode is NOT a valid workaround. 3. If the device ran a vulnerable version with SSL VPN exposed, check for compromise using Fortinet's guidance: unknown admin accounts, configuration changes, and symlink-based persistence in the SSL VPN language files that Fortinet described in 2025 (later FortiOS releases remove it). Rotate admin, VPN user and LDAP/RADIUS bind credentials. Verify: get system status shows a fixed (preferably current) version, and an external scan shows SSL VPN either patched or no longer exposed. Sources: https://www.fortiguard.com/psirt/FG-IR-24-015 https://nvd.nist.gov/vuln/detail/CVE-2024-21762 https://www.cisa.gov/known-exploited-vulnerabilities-catalog