# Fortinet FortiOS SSL VPN RCE vulnerability CVE-2024-21762

Published: 2024-02-25 · Severity: high · Sectors: technology, government-national, financial-services, healthcare, energy
Canonical: https://vorant.io/reports/1310e96d-6bc0-5859-b7ef-655f78d5fa66/fortinet-fortios-ssl-vpn-rce-vulnerability-cve-2024-21762

> Unauthenticated remote code execution in FortiOS SSL VPN allows attackers to execute arbitrary commands without credentials.

Fortinet disclosed a critical remote code execution vulnerability in FortiOS SSL VPN functionality, tracked as CVE-2024-21762. An unauthenticated remote attacker can send crafted requests to execute arbitrary code or commands on affected systems. The vulnerability poses significant risk as it requires no authentication and impacts SSL VPN gateways, which are often internet-facing and trusted for remote access. Fortinet released patched versions to address the flaw, and the vendor provided interim mitigation strategies for organizations unable to immediately patch.

## Mentioned in this report

- Vulnerabilities: CVE-2024-21762 (KEV)

## Detection guidance (public sample)

### FortiOS SSL VPN Daemon (sslvpnd) Crash - Possible Exploitation Attempt

ATT&CK: T1190

Detects FortiOS logging an sslvpnd application crash, a common side effect of failed memory-corruption exploitation of SSL VPN flaws such as CVE-2024-21762. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiOS SSL VPN Daemon (sslvpnd) Crash - Possible Exploitation Attempt
description: Detects FortiOS logging an 'Application crashed' event for the sslvpnd
  process. Unauthenticated memory-corruption bugs in the SSL VPN service (e.g. CVE-2024-21762)
  often crash sslvpnd when exploitation fails or is attempted repeatedly. Generalises
  on the process crash event, not on specific payloads. Review alongside inbound SSL
  VPN traffic and firmware version.
tags:
- attack.initial-access
- attack.t1190
logsource:
  product: fortios
  service: sslvpnd
detection:
  selection:
    logdesc: Application crashed
    msg|contains: sslvpnd
  condition: selection
falsepositives:
- Genuine sslvpnd software bugs on unpatched or unstable firmware causing crashes
  unrelated to exploitation
- Crashes following a configuration change or firmware upgrade on the gateway
level: medium
id: 1d554eb7-f323-5ed0-9410-f71bb0a0da7c
status: experimental
author: Vorant
references:
- https://www.ipa.go.jp/archive/security/security-alert/2023/alert20240209.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20240209.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1310e96d-6bc0-5859-b7ef-655f78d5fa66/fortinet-fortios-ssl-vpn-rce-vulnerability-cve-2024-21762.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup