Fortinet FortiOS SSL VPN Unauthenticated RCE (CVE-2024-21762)

Metadata

Affected Target

Summary

CVE-2024-21762 is a critical out-of-bounds write in FortiOS sslvpnd reachable through the SSL VPN web interface. A remote unauthenticated attacker can send crafted HTTP requests to corrupt memory and potentially achieve remote code execution. Public reporting and government advisories indicate active exploitation in the wild, and the vulnerability is listed in CISA KEV.

Vulnerability Details

Root Cause

The flaw is an out-of-bounds write condition in SSL VPN request processing inside the sslvpnd daemon. Crafted request data can push memory operations outside intended bounds, enabling attacker-controlled memory corruption.

Attack Vector

An attacker with network reachability to exposed FortiOS SSL VPN endpoints sends specially crafted HTTP(S) requests to vulnerable paths (commonly PoC examples use /remote/hostcheck_validate) to trigger the out-of-bounds write and pivot to an ROP-based execution path.

Impact

Successful exploitation can lead to unauthenticated remote code execution on perimeter security appliances. This can result in device takeover, lateral movement, credential access, and persistence from a highly privileged network position.

Environment / Lab Setup

OS:          Linux/macOS/Windows attacker host with Python 3
Target:      Authorized FortiOS SSL VPN endpoint in vulnerable version range
Attacker:    Security testing workstation
Tools:       Python 3, socket-capable network access, packet capture (optional)

Setup Steps

1
2
3

cd pocs/web/2026-05-16_fortios-sslvpn-rce-cve-2024-21762

python3 -m py_compile PoC.py

Proof of Concept

Step-by-Step Reproduction

1. Confirm authorized scope and reachable SSL VPN service.

   1	nc -vz <target-ip-or-hostname> 443

2. Edit target parameters in the PoC (TARGET_HOST, PORT) for your authorized lab target.

   1	sed -n '1,30p' PoC.py

3. Run the PoC to send crafted trigger traffic.

   1	python3 PoC.py

Exploit Code

See PoC.py in this folder.

1
2
3
4
5
6

import socket

TARGET_HOST = "x.x.x.x"
PORT = 80

data = b"POST /remote/hostcheck_validate HTTP/1.1\r\n"

Expected Output

Screenshots / Evidence

• screenshots/ — add authorized captures (traffic traces, target crash logs, controlled exploit validation)

Detection & Indicators of Compromise

SIEM / IDS Rule (example):

alert http any any -> $HOME_NET 443 (
  msg:"Possible FortiOS CVE-2024-21762 exploitation attempt";
  flow:to_server,established;
  content:"POST"; http_method;
  content:"/remote/hostcheck_validate"; http_uri;
  sid:952421762; rev:1;
)

Remediation

References

• CVE-2024-21762 — NVD
• Fortinet PSIRT Advisory FG-IR-24-015
• CISA Known Exploited Vulnerabilities Catalog
• Joint CSA: PRC state-sponsored actors compromise and maintain persistent access to U.S. critical infrastructure
• Source Repository — d0rb/CVE-2024-21762

Notes

Auto-ingested from https://github.com/d0rb/CVE-2024-21762 on 2026-05-16.