FG-IR-24-015: Out-of-bound Write in sslvpnd
A out-of-bounds write vulnerability [CWE-787] in FortiOS and FortiProxy may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests.
Workaround : disable SSL VPN (disable webmode is NOT a valid workaround)
Note: This is potentially being exploited in the wild.
Affected Software
Event History
Frequently Asked Questions
What is the severity of FG-IR-24-015?
The FG-IR-24-015 vulnerability is classified as a critical security issue that can allow remote unauthenticated attackers to execute arbitrary code.
How do I fix FG-IR-24-015?
To mitigate FG-IR-24-015, upgrade to the appropriate FortiOS or FortiProxy versions as specified in the advisory.
What products are affected by FG-IR-24-015?
The FG-IR-24-015 vulnerability affects FortiOS and FortiProxy versions from 7.4.0 to 7.4.2, and other specified versions down to 6.0.0.
Can the FG-IR-24-015 vulnerability be exploited remotely?
Yes, FG-IR-24-015 can be exploited remotely via specially crafted HTTP requests.
What is a temporary workaround for FG-IR-24-015?
A temporary workaround for FG-IR-24-015 is to disable the SSL VPN, as disabling web mode is not a valid solution.