Fortinet · FortiOS
CVE-2024-21762
Fortinet FortiOS Out-of-Bound Write Vulnerability
概要
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CISA: Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.
対処法
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2024年2月16日
Fortinetのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/07/27 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | 中 5.3 | 29% |
| 2025/06/25 | Use of Hard-Coded Credentials | FortiOS | 中 6.5 | 6.6% |
| 2023/03/14 | Path Traversal | FortiOS | 中 6.5 | 11% |
| 2022/12/13 | Heap-Based Buffer Overflow | FortiOS | 緊急 9.3 | 99.5% |
| 2021/12/10 | Arbitrary File Download | FortiOS | 低 3.3 | 0.9% |
| 2021/11/03 | Default Configuration | FortiOS | 中 6.5 | 19% |
| 2021/11/03 | SSL VPN Path Traversal | FortiOS | 緊急 9.1 | >99.9% |
| 2021/11/03 | SSL VPN Improper Authentication | FortiOS | 高 7.5 | 45% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。