Actively exploited in the wild
Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet - FortiOS · Listed in the CISA KEV since 2024-02-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21762
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
An out-of-bounds write in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests. Affects multiple versions of FortiOS and FortiProxy.
Risk Assessment
An attacker can remotely execute code on firewall devices, potentially leading to full network compromise.
Recommendation
Update FortiOS and FortiProxy to patched versions and restrict access to management interfaces.
Other vulnerabilities in Fortinet FortiOS
See all- CVE-2017-7738High
CVE-2017-7738 is an Information Disclosure vulnerability in Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below, allowing an admin user with super_admin privileges to view current SSL VPN web portal session info, which may contain user credentials.
- CVE-2024-23113CriticalActively exploited
A use of externally-controlled format string in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2022-41328MediumActively exploited
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0 through 7.0.9 and before 6.4.11 allows a privileged attacker to read and write files on the underlying Linux system via crafted CLI commands.
- CVE-2018-13374MediumActively exploited
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
- CVE-2026-84392Low
A NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS 7.4 and 7.2 (all versions), FortiPAM (multiple versions), and FortiProxy 7.6.0-7.6.6, 7.4, and 7.2 (all versions) may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
- CVE-2025-67862Medium
Fortinet FortiOS and FortiProxy in multiple versions contain a vulnerability exposing an internal asset to an unsafe debug access level. This allows an authenticated admin to execute Lua scripts via crafted CLI commands.
- CVE-2025-53844High
An out-of-bounds write vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58413High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, 6.4, 6.2, and 6.0. An attacker can execute unauthorized code or commands via specially crafted packets.
- CVE-2025-53843High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4. An attacker can exploit this vulnerability to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58903Low
CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.
Original NVD description (English source)
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests