Probably Exploited Fortinet Flaw Impacts Many Methods, however No Indicators of Mass Assaults

Roughly one month in the past, Fortinet patched a crucial FortiOS vulnerability and warned clients about potential exploitation. Many methods are impacted, however there nonetheless don’t look like any indicators of large-scale assaults.

The vulnerability, tracked as CVE-2024-21762, has been described as an out-of-bounds write challenge in FortiOS and FortiProxy that may enable a distant, unauthenticated attacker to execute arbitrary code or instructions by means of specifically crafted HTTP requests. 

When it disclosed the zero-day flaw on February 9, Fortinet mentioned it was ‘probably being exploited within the wild’. CISA added CVE-2024-21762 to its Recognized Exploited Vulnerabilities Catalog just a few days later.

No particulars appear to be accessible on assaults exploiting CVE-2024-21762 and there may be at present no proof of widespread assaults. 

Fortinet vulnerabilities are sometimes initially exploited in extremely focused assaults by subtle menace actors, however mass exploitation will not be unusual, significantly after a patch is launched and knowledge turns into public. 

On this case, greater than a month has handed because the preliminary disclosure and there are nonetheless no reviews of mass assaults. Risk intelligence firm GreyNoise, which carried out a technical evaluation of the safety gap, has been monitoring CVE-2024-21762 exploitation makes an attempt, however its honeypots have but to see any assaults. 

Fortinet additionally doesn’t appear to have confirmed exploitation — its advisory nonetheless says ‘probably being exploited’.

The non-profit cybersecurity group Shadowserver is seeing practically 150,000 Fortinet product situations which may be impacted by CVE-2024-21762, nevertheless it has not talked about something about seeing precise assault makes an attempt. 

The best proportion of probably weak methods seen by Shadowserver is in america, adopted by India. Hundreds of situations have been seen in Europe, China, Canada, Mexico and Brazil. 

Bishop Fox gives an open supply device that organizations can use to find out whether or not an equipment is impacted by the vulnerability.

Associated: Fortinet Warns Clients of Potential Zero-Day Exploited in Restricted Assaults

Associated: Fortinet Patches Vital Vulnerabilities in FortiSIEM

Associated: Fortinet Patches Excessive-Severity Vulnerabilities in FortiOS, FortiProxy, FortiWeb Merchandise