IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
9.6Kritisch KEV In Ransomware genutzt

CVE-2024-21762Fortinet FortiOS Out-of-Bound Write Vulnerability

Fortinet FortiOS; Fortinet FortiProxy; fortinet fortiproxy; fortinet fortios Veröffentlicht: (vor 2 Jahren)

Bekannt ausgenutzt — Fortinet FortiOS Out-of-Bound Write Vulnerability

CISA hat am 09.02.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 16.02.2024.

Erforderliche Maßnahme: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ; https://nvd.nist.gov/vuln/detail/CVE-2024-21762

Beschreibung

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests

Schwachstellentyp (CWE): CWE-787

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Fortinet FortiOS 7.4.0 – ≤ 7.4.2, 7.2.0 – ≤ 7.2.6, 7.0.0 – ≤ 7.0.13, 6.4.0 – ≤ 6.4.14, 6.2.0 – ≤ 6.2.15, 6.0.0 – ≤ 6.0.18
Fortinet FortiProxy 7.4.0 – ≤ 7.4.2, 7.2.0 – ≤ 7.2.8, 7.0.0 – ≤ 7.0.14, 2.0.0 – ≤ 2.0.13, 1.2.1 – ≤ 1.2.13, 01.02.00, 1.1.4 – ≤ 1.1.6, 01.01.00 – ≤ 01.01.03, 01.00.00 – ≤ 01.00.07

Referenzen und Patches

CPE-Treffer (NVD) (10)
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 1.0.0 < 2.0.14
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.15
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.9
  • cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.3
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.0.0 < 6.0.18
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.2.0 < 6.2.16
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 6.4.0 < 6.4.15
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.0.0 < 7.0.14
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.2.0 < 7.2.7
  • cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* ≥ 7.4.0 < 7.4.3

Neue CVEs im selben Produkt — Fortinet (all products)

6.7Mittel
CVE-2026-106174
Fortinet FortiOS

A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

9.6Kritisch
CVE-2026-107656
Fortinet FortiSandbox; Fortinet FortiSandbox PaaS

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions,…

2.1Niedrig
CVE-2026-106175
Fortinet FortiOS; Fortinet FortiSwitch; Fortinet FortiProxy

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions…

4.9Mittel
CVE-2026-106172
Fortinet FortiSandbox; Fortinet FortiSandbox Cloud

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Clo…

7.9Hoch
CVE-2025-46773
Fortinet FortiAnalyzer Cloud; Fortinet FortiAnalyzer

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud …

6.5Mittel
CVE-2026-23705
Fortinet FortiAnalyzer; Fortinet FortiManager

An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.13, FortiManager 7.4…