FortiOS - RCE (CVE-2024-21762)

CVE-2024-21762 is an out-of-bounds write vulnerability affecting multiple versions of Fortinet FortiProxy and FortiOS. This flaw allows attackers to execute unauthorized code or commands on the affected systems by sending specially crafted requests, potentially leading to full system compromise or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2025.

CrowdSec network data shows that most actors exploiting CVE-2024-21762 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. CrowdSec data also reveals a clear uptick in attacks involving CVE-2024-21762 over the past week. Activity is above the usual baseline, suggesting growing attention from attackers. This may reflect rising awareness, recent exploit releases, or expanded targeting efforts.

Attackers exploit CVE-2024-23113 by sending specially crafted POST requests to the /remote/vulncheck endpoint on Fortinet FortiOS SSL VPN interfaces, attempting to trigger a heap buffer underflow vulnerability.