133k+ Fortinet appliances still vulnerable to CVE-2024-21762

The volume of Fortinet boxes exposed to the public internet and vulnerable to a month-old critical security flaw in FortiOS is still extremely high, despite a gradual increase in patching. According to security nonprofit Shadowserver's latest data, the number of Fortinet appliances vulnerable to CVE-2024-21762 stands at more than 133,000 – down only slightly from more than 150,000 ten days prior. Fortinet patched CVE-2024-21762 in early February, well over a month ago. It's a 9.6-out-of-10 severity vulnerability that leads to remote code execution (RCE) and appeared front and center during Fortinet's week to forget last month. The biggest number of exposures is in Asia, with 54,310 appliances still vulnerable to the critical RCE bug, the data shows. North America and Europe fill the second and third spots with 34,945 and 28,058 respectively, while South America, Africa, and Oceania comprise the remainder. The number of exposed SSL VPNs illustrates the wide attack surface for the critical vulnerability, one that's already known to be actively exploited. When it was first disclosed by Fortinet, the vendor said there was evidence of it being used as a zero day. The US government's Cybersecurity and Infrastructure Security Agency (CISA) soon corroborated this by adding it to the Known Exploited Vulnerability (KEV) catalog, thereby requiring all federal agencies to patch it within a tight deadline. Proof of concepts are now relatively widely available online, meaning the likelihoo...