Security News > 2024 > February > New Fortinet RCE flaw in SSL VPN likely exploited in attacks
Fortinet is warning that a new critical remote code execution vulnerability in FortiOS SSL VPN is potentially being exploited in attacks.
For those unable to apply patches, you can mitigate the flaw by disabling SSL VPN on your FortiOS devices.
Threat actors commonly target Fortinet flaws to breach corporate networks for ransomware attacks and cyber espionage.
Yesterday, Fortinet disclosed that Chinese state-sponsored threat actors known as Volt Typhoon targeted FortiOS vulnerabilities to deploy custom malware known as COATHANGER. This malware is a custom remote access trojan designed to infect Fortigate network security appliances and was recently found used in attacks on the Dutch Ministry of Defence.
Due to the high severity of the newly disclosed CVE-2024-21762 flaw and the likelihood of it being exploited in attacks, it is strongly advised that you update your devices as soon as possible.
Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure.
News URL
Related news
- SonicWall firewalls now under attack: Patch ASAP or risk intrusion via your SSL VPN (source)
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Fortinet Warns of New Zero-Day Used in Attacks on Firewalls with Exposed Interfaces (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack (source)
- 48,000+ internet-facing Fortinet firewalls still open to attack (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks (source)
- Week in review: 48k Fortinet firewalls open to attack, attackers “vishing” orgs via Microsoft Teams (source)
- Critical RCE bug in Microsoft Outlook now exploited in attacks (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-02-09 | CVE-2024-21762 | Unspecified vulnerability in Fortinet Fortios and Fortiproxy A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests | 9.8 |