Fortinet FortiOS SSL VPN RCE vulnerability CVE-2024-21762
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote code execution in FortiOS SSL VPN allows attackers to execute arbitrary commands without credentials.
Fortinet disclosed a critical remote code execution vulnerability in FortiOS SSL VPN functionality, tracked as CVE-2024-21762. An unauthenticated remote attacker can send crafted requests to execute arbitrary code or commands on affected systems. The vulnerability poses significant risk as it requires no authentication and impacts SSL VPN gateways, which are often internet-facing and trusted for remote access. Fortinet released patched versions to address the flaw, and the vendor provided interim mitigation strategies for organizations unable to immediately patch.
Mentioned in this report
Detection guidance
FortiOS SSL VPN Daemon (sslvpnd) Crash - Possible Exploitation Attempt
Detects FortiOS logging an sslvpnd application crash, a common side effect of failed memory-corruption exploitation of SSL VPN flaws such as CVE-2024-21762. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS SSL VPN Daemon (sslvpnd) Crash - Possible Exploitation Attempt
description: Detects FortiOS logging an 'Application crashed' event for the sslvpnd
process. Unauthenticated memory-corruption bugs in the SSL VPN service (e.g. CVE-2024-21762)
often crash sslvpnd when exploitation fails or is attempted repeatedly. Generalises
on the process crash event, not on specific payloads. Review alongside inbound SSL
VPN traffic and firmware version.
tags:
- attack.initial-access
- attack.t1190
logsource:
product: fortios
service: sslvpnd
detection:
selection:
logdesc: Application crashed
msg|contains: sslvpnd
condition: selection
falsepositives:
- Genuine sslvpnd software bugs on unpatched or unstable firmware causing crashes
unrelated to exploitation
- Crashes following a configuration change or firmware upgrade on the gateway
level: medium
id: 1d554eb7-f323-5ed0-9410-f71bb0a0da7c
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2023/alert20240209.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20240209.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs