login
quiescence.eu
Naar inhoud

CVE-2024-21762

Fortinet FortiOS Out-of-Bound Write Vulnerability

n/a
CVSS
84.3%
EPSS (exploit prob.)
99.7%
EPSS percentile
Yes
Actively exploited
Yes
Ransomware use
2024-02-09
Added

MITRE ATT&CK techniques

How this vulnerability maps to adversary behaviour, from the Center for Threat-Informed Defense's public CVE→ATT&CK mappings. Use it to check whether your detections already cover the technique.

TechniqueNameRelationship
T1190 Exploit Public-Facing Application exploitation technique
T1574 Hijack Execution Flow primary impact
T1547.009 Shortcut Modification secondary impact

Summary

Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

Affected software

Vendor: Fortinet  ·  Product: FortiOS

Weakness types (CWE):

CWE-787

What to do

This vulnerability appears in CISA's Known Exploited Vulnerabilities catalog, meaning it is being exploited in the wild. Prioritize patching affected systems and verify exposure across your estate.

Related vulnerabilities in Fortinet

CVENameEPSSExploited
CVE-2018-13379 Fortinet FortiOS SSL VPN Path Traversal Vulnerability 100.0% Yes
CVE-2022-40684 Fortinet Multiple Products Authentication Bypass Vulnerability 100.0% Yes
CVE-2022-42475 Fortinet FortiOS Heap-Based Buffer Overflow Vulnerability 99.5% Yes
CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability 98.3% Yes
CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Vulnerability 97.6% Yes
CVE-2025-25257 Fortinet FortiWeb SQL Injection Vulnerability 96.7% Yes
CVE-2024-47575 Fortinet FortiManager Missing Authentication Vulnerability 94.8% Yes
CVE-2026-21643 Fortinet FortiClient EMS SQL Injection Vulnerability 94.1% Yes

Is your domain exposed?

Run a free, instant security report for any domain — exposure score, email auth, TLS and breach metadata.

Get your free report

All information is aggregated from public sources for awareness only and does not constitute an accusation or a security assessment. No personal data or credentials are published.