{"slug":"fortios-ssl-vpn","title":"FortiOS SSL VPN RCE (CVE-2024-21762)","shortName":"FortiOS SSL VPN","summary":"Unauthenticated out-of-bounds write in FortiOS and FortiProxy SSL VPN HTTP parsing, enabling remote code execution. CVSS 9.8. Fortinet said it was potentially exploited at disclosure (8 Feb 2024). CISA KEV 9 Feb 2024; ransomware Known. In April 2025 Fortinet documented symlink persistence that can survive the original patch.","isExample":false,"draft":false,"family":"fortios-ssl-vpn","kind":"single-product","aliases":["CVE-2024-21762","FG-IR-24-015","Two Bytes is Plenty"],"publishedAt":"2024-02-08","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2024-21762","cvss":{"cve":"CVE-2024-21762","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-21762","sourceDate":"2026-10-22","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2024-21762","score":0.83428,"percentile":0.99685,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2024-21762","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2024-21762","listed":true,"dateAdded":"2024-02-09","dueDate":"2024-02-16","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated out-of-bounds write remote code execution in FortiOS and FortiProxy SSL VPN (CVE-2024-21762). CVSS 9.8. Fortinet said it was potentially exploited on 8 Feb 2024. Listed in CISA KEV; ransomware Known.","action":"Confirm FortiOS or FortiProxy is on a FG-IR-24-015 fixed release, disable SSL VPN if you cannot patch, and hunt the April 2025 language-file symlink."},"seenInTheWild":[{"metric":"vendor-stated","value":"This is potentially being exploited in the wild.","observer":"Fortinet","date":"2024-02-08","method":"Vendor note on FG-IR-24-015 at initial publication. Not a confirmation; CISA KEV is the confirmation slot.","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2024-02-09","method":"CISA Known Exploited Vulnerabilities catalog dateAdded. knownRansomwareCampaignUse Known.","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Shadowserver dashboard","url":"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2024-21762%2B&dataset=unique_ips&style=stacked","observer":"Shadowserver","metric":"possibly-vulnerable"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Page added","section":"overview"},{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2024-21762 is an out-of-bounds write (CWE-787) in Fortinet FortiOS and FortiProxy SSL VPN. A remote unauthenticated attacker can execute code or commands via specially crafted HTTP requests. Fortinet rates CVSS 9.8 and noted at publication (8 Feb 2024) that the issue was potentially being exploited in the wild.\n\nPreconditions: the SSL VPN feature is enabled and reachable. An unauthenticated attacker needs HTTP(S) access to the SSL VPN interface. The only complete vendor workaround is to disable SSL VPN entirely. Disabling webmode alone is not a valid workaround (FG-IR-24-015).\n\nAssetnote's 15 Mar 2024 analysis showed the bug in chunked-transfer trailer handling inside SSL VPN request parsing. On a tested FortiOS 7.2.5 build, a two-byte out-of-bounds write was enough to corrupt a saved pointer and reach code execution. This page does not republish exploit details.\n\nFixed FortiOS builds begin at 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16, and 6.0.18. Fixed FortiProxy builds begin at 7.4.3, 7.2.9, 7.0.15, and 2.0.14. FortiProxy 1.x must migrate. FortiGuard virtual patch signature HTTP.Chunk.Length.Invalid. (FMWP db update 24.020) is a temporary control.\n\nOn 10 Apr 2025 Fortinet disclosed a separate post-exploitation technique: a symbolic link in SSL-VPN language files used after this and earlier FortiOS RCEs to keep read-only filesystem access even after the original access vector was locked down. Devices that never enabled SSL VPN are not impacted by that persistence issue, per Fortinet. CCCS AL25-005 (14 Apr 2025) points to later cleanup builds 7.6.2, 7.4.7, 7.2.11, 7.0.17, and 6.4.16.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"SSL VPN reachability","detail":"Unauthenticated access to an internet-facing FortiOS or FortiProxy SSL VPN interface."},{"id":"unsafe","label":"Crafted chunked HTTP","detail":"A malformed chunked request triggers an out-of-bounds write in SSL VPN HTTP parsing."},{"id":"exec","label":"Code execution","detail":"Attacker code runs on the firewall or proxy OS. Conceptual impact class only."},{"id":"persist","label":"Optional persistence","detail":"Observed follow-on includes a language-file symlink that can outlive the original RCE patch (Fortinet, Apr 2025)."}]},"exploitation":{"kev":{"listed":true,"date":"2024-02-09","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV CVE-2024-21762 Fortinet FortiOS Out-of-Bound Write Vulnerability. dateAdded 2024-02-09, due 2024-02-16. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2024-02-08","source":"Fortinet FG-IR-24-015","note":"Vendor note at initial publication: this is potentially being exploited in the wild. Exact first compromise day is not stated."},"vendorStatements":[{"vendor":"Fortinet","date":"2024-02-08","statement":"An out-of-bounds write vulnerability in FortiOS and FortiProxy may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests. Note: This is potentially being exploited in the wild. Workaround: disable SSL VPN (disable webmode is NOT a valid workaround).","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","retracted":false},{"vendor":"Fortinet","date":"2025-04-10","statement":"A threat actor used known vulnerabilities (including FG-IR-24-015) then created a symbolic link in SSL-VPN language files to maintain read-only access after the original access vector was locked down. Customers who never enabled SSL-VPN are not impacted by that persistence issue.","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","retracted":false}]},"timeline":[{"date":"2024-02-08","event":"Fortinet publishes FG-IR-24-015. The advisory rates the issue CVSS 9.8, says it is potentially being exploited in the wild, and says disabling webmode is not a valid workaround.","source":{"title":"FG-IR-24-015","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","publisher":"Fortinet"},"kind":"advisory","key":true,"addedDate":"2026-10-24"},{"date":"2024-02-09","event":"CISA adds CVE-2024-21762 to KEV (due 16 Feb 2024). knownRansomwareCampaignUse Known.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-24"},{"date":"2024-03-15","event":"Assetnote publishes Two Bytes is Plenty, a public technical analysis of the chunked-trailer out-of-bounds write on a tested FortiOS 7.2.5 build.","source":{"title":"Two Bytes is Plenty","url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","publisher":"Assetnote"},"kind":"poc","key":true,"addedDate":"2026-10-24"},{"date":"2025-04-10","event":"Fortinet documents a language-file symlink used after FG-IR-24-015 and earlier FortiOS RCEs to keep read-only filesystem access after the original vector is closed.","source":{"title":"Analysis of Threat Actor Activity","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","publisher":"Fortinet"},"kind":"vendor","key":true,"addedDate":"2026-10-24"},{"date":"2025-04-11","event":"CISA points to the Fortinet post-exploitation advisory.","source":{"title":"Fortinet Releases Advisory on New Post-Exploitation Technique","url":"https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities","publisher":"CISA"},"kind":"vendor","addedDate":"2026-10-24"},{"date":"2025-04-14","event":"CCCS AL25-005 echoes the persistence finding and lists cleanup builds plus credential reset.","source":{"title":"CCCS AL25-005","url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","publisher":"Canadian Centre for Cyber Security"},"kind":"advisory","key":true,"addedDate":"2026-10-24"}],"openNotes":[{"title":"First confirmed compromise day is not stated","detail":"Fortinet said the issue was potentially being exploited as of 8 Feb 2024. No primary source reviewed here stamps an earlier first day.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}]}],"defenderActions":[{"title":"Upgrade FortiOS or FortiProxy to a fixed release","detail":"FortiOS: 7.4.3+, 7.2.7+, 7.0.14+, 6.4.15+, 6.2.16+, 6.0.18+. FortiProxy: 7.4.3+, 7.2.9+, 7.0.15+, 2.0.14+ (1.x migrate). Prefer also the Apr 2025 persistence-cleanup builds named by CCCS (7.6.2 / 7.4.7 / 7.2.11 / 7.0.17 / 6.4.16).","priority":"now","links":[{"label":"FG-IR-24-015","href":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015"},{"label":"Fortinet persistence blog","href":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity"}]},{"title":"If you cannot patch immediately, disable SSL VPN","detail":"Vendor workaround is to disable SSL VPN. Disabling webmode alone is not valid.","priority":"now"},{"title":"Hunt for language-file symlink persistence","detail":"Even after the RCE patch, check for the SSL-VPN language-file symlink described 10 Apr 2025. Reset credentials and review config if impact is plausible.","priority":"now","links":[{"label":"CCCS AL25-005","href":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762"}]},{"title":"Apply FortiGuard virtual patch if licensed","detail":"FMWP signature HTTP.Chunk.Length.Invalid. (db update 24.020) is a temporary control, not a substitute for upgrading.","priority":"soon"}],"detection":[{"title":"Safe chunked-versus-normal SSL VPN behaviour check","detail":"Bishop Fox and community checkers compare responses to normal versus chunked POSTs on the SSL-VPN interface to infer vulnerability without exploitation. Run this against the SSL-VPN VIP, not management 443.","logSource":"Active check versus SSL-VPN VIP","kind":"generic"},{"title":"IPS hit HTTP.Chunk.Length.Invalid.","detail":"FortiGuard virtual patch / IPS signature for malformed chunk length or trailers (FMWP 24.020 and later).","logSource":"FortiGate IPS / AV logs","kind":"vendor-signature","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08"},{"title":"sslvpnd instability","detail":"Unexpected sslvpnd crashes or restarts around anomalous chunked requests on the VPN interface.","logSource":"crashlog / SSL VPN logs (diagnose debug crashlog read)","kind":"generic"},{"title":"Language-file symlink under SSL-VPN lang paths","detail":"Fortinet Apr 2025 persistence: a symlink tying a user language-file folder to the root filesystem for read-only exfil of configs.","logSource":"Appliance filesystem","kind":"generic"},{"title":"No public Sigma or Splunk detection file located","detail":"A 24 Oct 2026 check of SigmaHQ/sigma emerging-threats listings and splunk/security_content found no detection file for CVE-2024-21762. Use the pointers above and the Bishop Fox check.","logSource":"Public rule repositories","kind":"generic"}],"detectionRules":[],"detectionLinks":[{"title":"FG-IR-24-015 (fixed builds, workaround, virtual patch)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","author":"Fortinet","date":"2024-02-08"},{"title":"Bishop Fox safe vulnerability check","url":"https://github.com/BishopFox/cve-2024-21762-check","author":"Bishop Fox","date":"2024-02-28","note":"Detection-only. Compares normal versus chunked POST behaviour."},{"title":"Fortinet: Analysis of Threat Actor Activity","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","author":"Fortinet","date":"2025-04-10"}],"retrohunt":{"summary":"Search FortiGate IPS, crash, and SSL VPN logs from 8 Feb 2024 for HTTP.Chunk.Length.Invalid. hits and sslvpnd crashes, then inspect language-file folders for the Apr 2025 symlink even on boxes that already have the original RCE patch.","lookback":{"from":"2024-02-08","basis":"first-exploitation","rationale":"Fortinet said the issue was potentially exploited as of the 8 Feb 2024 advisory. Public analysis landed 15 Mar 2024. Fortinet documented persistence artefacts on 10 Apr 2025. Keep SSL VPN and crash logs for the full retention period of internet-exposed gateways.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"}]},"logSources":[{"name":"FortiGate IPS / AV logs","why":"HTTP.Chunk.Length.Invalid. is the FortiGuard virtual-patch signature named in FG-IR-24-015.","required":true},{"name":"crashlog / sslvpnd logs","why":"Unexpected sslvpnd restarts around crafted chunked requests.","required":true},{"name":"Appliance filesystem (SSL-VPN language-file folders)","why":"Fortinet Apr 2025 symlink persistence.","required":true},{"name":"SSL VPN authentication logs and config revisions","why":"CCCS recommends watching unauthorized logins and config diffs.","required":false}],"steps":[{"title":"Search IPS logs for HTTP.Chunk.Length.Invalid.","detail":"FG-IR-24-015 names FMWP signature HTTP.Chunk.Length.Invalid. (db update 24.020) as the virtual patch.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}]},{"title":"Review sslvpnd crash history","detail":"Assetnote's analysis context includes sslvpnd instability around crafted chunked requests. Use diagnose debug crashlog read on the appliance.","sources":[{"url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","date":"2024-03-15","publisher":"Assetnote"}]},{"title":"Inspect SSL-VPN language-file folders for a symlink to the root filesystem","detail":"Fortinet (10 Apr 2025) and CCCS AL25-005 describe a symlink under language-file folders that retains read-only FS access after the RCE patch. Devices that never enabled SSL VPN are not impacted by that persistence issue.","sources":[{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}]}],"queries":[{"id":"v2s-rh-spl-fortios-chunk-ips","title":"FortiGate IPS hits for HTTP.Chunk.Length.Invalid. since 8 Feb 2024","language":"spl","query":"index=* earliest=\"02/08/2024:00:00:00\" (sourcetype=\"fortigate:ips\" OR sourcetype=\"fgt_ips\" OR sourcetype=\"fortigate\")\n\"HTTP.Chunk.Length.Invalid\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(action) as action by src_ip, dest_ip, dest_port\n| convert ctime(firstTime) ctime(lastTime)","logSource":"FortiGate IPS / AV logs in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","sourceDate":"2024-02-08","license":"CC0 1.0","origin":"vuln2shell","notes":"Signature name from FG-IR-24-015. Confirm the sourcetype your add-on uses.","tested":"untested","timeRange":"From 2024-02-08"},{"id":"v2s-rh-kql-fortios-chunk-ips","title":"FortiGate IPS hits for HTTP.Chunk.Length.Invalid. since 8 Feb 2024","language":"kql","query":"CommonSecurityLog\n| where TimeGenerated >= datetime(2024-02-08)\n| where DeviceVendor has \"Fortinet\"\n| where AdditionalExtensions has \"HTTP.Chunk.Length.Invalid\" or Message has \"HTTP.Chunk.Length.Invalid\" or Activity has \"HTTP.Chunk.Length.Invalid\"\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, DeviceAction","logSource":"FortiGate IPS logs via CEF in Microsoft Sentinel (CommonSecurityLog)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","sourceDate":"2024-02-08","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-02-08, limited by retention"},{"id":"v2s-rh-logscale-fortios-sslvpnd","title":"sslvpnd crash or restart lines","language":"logscale","query":"// Set the time picker to start 2024-02-08\n/sslvpnd/\n| /(crash|restart|abort|died|signal)/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"FortiOS crashlog / SSL VPN logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","sourceDate":"2024-03-15","license":"CC0 1.0","origin":"vuln2shell","notes":"Heuristic only. Confirm crashlog ingest before treating a hit as exploitation.","tested":"untested","timeRange":"From 2024-02-08"}],"thirdPartyQueries":[{"title":"Bishop Fox safe vulnerability check","url":"https://github.com/BishopFox/cve-2024-21762-check","author":"Bishop Fox","date":"2024-02-28","language":"guide","license":"see source","origin":"community","note":"Detection-only comparison of normal versus chunked POST behaviour on the SSL-VPN VIP."},{"title":"CCCS AL25-005 persistence cleanup","url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","author":"Canadian Centre for Cyber Security","date":"2025-04-14","language":"guide","license":"public","origin":"vendor","note":"Cleanup builds and credential-reset advice after the language-file symlink."}],"artefacts":[{"kind":"device-log","value":"IPS/AV hit HTTP.Chunk.Length.Invalid.","detail":"FortiGuard virtual-patch signature named in FG-IR-24-015.","sourceUrl":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","sourceDate":"2024-02-08"},{"kind":"file","value":"Symbolic link in SSL-VPN language-file folders pointing at the root filesystem","detail":"Post-exploitation persistence described by Fortinet on 10 Apr 2025.","sourceUrl":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","sourceDate":"2025-04-10"}],"iocNote":"No file hashes from Fortinet or CCCS primary text are indexed here.","hitMeaning":[{"level":"attempt","detail":"An IPS hit for HTTP.Chunk.Length.Invalid. with no crash and no filesystem change."},{"level":"likely-compromise","detail":"sslvpnd crash or restart clustered with anomalous chunked requests, or unauthorized SSL-VPN logins."},{"level":"confirmed-compromise","detail":"A language-file symlink to the root filesystem, or other persistence named by Fortinet / CCCS."}],"nextSteps":[{"title":"Upgrade, then apply persistence cleanup","detail":"Install a fixed RCE build. If SSL VPN was ever enabled, also move to a cleanup build named by CCCS and reset credentials.","links":[{"label":"FG-IR-24-015","href":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015"},{"label":"CCCS AL25-005","href":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762"}]},{"title":"Review config revisions","detail":"CCCS recommends checking unauthorized SSL-VPN logins and config diffs."}],"limits":["The original RCE patch does not remove the Apr 2025 language-file symlink.","No primary hash list is quoted here.","Devices that never sent IPS or crash logs off-box have no history after rotation."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"FortiOS 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, and 6.0.0 through 6.0.17, plus FortiProxy trains listed in FG-IR-24-015, are in scope when SSL VPN is enabled and reachable. FortiProxy 1.x must migrate. Disabling webmode alone is not a valid workaround.","checks":[{"id":"v2s-aia-fortios-ssl-vpn-version-1","kind":"version","title":"Read the FortiOS or FortiProxy firmware against first-fixed builds","detail":"FG-IR-24-015: FortiOS upgrade to 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16, or 6.0.18 or above on those trains. FortiProxy: 7.4.3, 7.2.9, 7.0.15, or 2.0.14 or above; 1.x migrate. CCCS AL25-005 later names persistence-cleanup builds 7.6.2, 7.4.7, 7.2.11, 7.0.17, and 6.4.16. Record the firmware from the GUI System Information widget. No public CLI version string was copied from FG-IR-24-015 in this pass.","command":"In the FortiOS or FortiProxy GUI System Information widget, record the firmware version and compare it to FG-IR-24-015 first-fixed builds.","affectedMeans":"FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6, 7.0.0-7.0.13, 6.4.0-6.4.14, 6.2.0-6.2.15, 6.0.0-6.0.17, or a FortiProxy train below 7.4.3 / 7.2.9 / 7.0.15 / 2.0.14, or any FortiProxy 1.x, if SSL VPN is enabled (next check).","fixedMeans":"FortiOS 7.4.3+, 7.2.7+, 7.0.14+, 6.4.15+, 6.2.16+, or 6.0.18+, or FortiProxy 7.4.3+ / 7.2.9+ / 7.0.15+ / 2.0.14+, after SSL VPN inventory. Prefer also a CCCS cleanup build if SSL VPN was ever enabled.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21762","date":"2024-02-09","publisher":"NVD"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}]},{"id":"v2s-aia-fortios-ssl-vpn-config-2","kind":"config","title":"Confirm SSL VPN is enabled and reachable","detail":"FG-IR-24-015 workaround is to disable SSL VPN entirely. Disabling webmode is not a valid workaround. Fortinet (10 Apr 2025): devices that never enabled SSL VPN are not impacted by the later language-file persistence issue.","command":"In VPN > SSL-VPN Settings (or the FortiProxy equivalent), record whether SSL VPN is enabled and which interface it listens on.","affectedMeans":"SSL VPN is enabled on a firmware below the first-fixed release for that train, or webmode was disabled while SSL VPN itself stayed on.","fixedMeans":"SSL VPN is disabled, or the device is on a first-fixed release and, if SSL VPN was ever enabled, reviewed for the April 2025 language-file symlink.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"}]},{"id":"v2s-aia-fortios-ssl-vpn-package-3","kind":"package","title":"Inventory the FortiGuard virtual-patch signature if licensed","detail":"FG-IR-24-015 names FMWP signature HTTP.Chunk.Length.Invalid. (db update 24.020) as a temporary control. This is signature-pack inventory, not a substitute for the version check.","command":"In FortiGuard IPS / AV signature lists, confirm HTTP.Chunk.Length.Invalid. is present after FMWP db update 24.020 or later.","affectedMeans":"The signature is absent or older than db update 24.020 while SSL VPN is still enabled on a vulnerable build.","fixedMeans":"HTTP.Chunk.Length.Invalid. is present after 24.020. This is an interim control only; FG-IR-24-015 still requires a fixed firmware.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}]}],"limits":["A firmware string alone does not prove SSL VPN is off.","Disabling webmode is not the vendor workaround.","The original RCE patch does not remove the April 2025 language-file symlink.","No sourced Shodan product query is published on this page; do not invent one."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21762","date":"2024-02-09","publisher":"NVD"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Fortinet documents two interim controls: disable SSL VPN entirely, and apply FortiGuard virtual patch HTTP.Chunk.Length.Invalid. (FMWP 24.020). Neither replaces a fixed firmware. Disabling webmode is not valid.","items":[{"title":"Disable SSL VPN until upgraded","detail":"FG-IR-24-015 workaround: disable SSL VPN. The same advisory says disable webmode is not a valid workaround. This removes the unauthenticated HTTP path to sslvpnd until a first-fixed build is installed.","limits":"Not a software fix. Breaks remote SSL VPN access. Does not remove the April 2025 language-file symlink if the device was already compromised. Still upgrade to 7.4.3 / 7.2.7 / 7.0.14 / 6.4.15 / 6.2.16 / 6.0.18 (FortiOS) or the matching FortiProxy fixed train.","verify":"In VPN > SSL-VPN Settings, SSL VPN status is disabled. Confirm the SSL VPN interface is no longer accepting HTTPS sessions. A webmode-only change is not this mitigation.","source":{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}},{"title":"Apply FortiGuard virtual patch HTTP.Chunk.Length.Invalid. if licensed","detail":"FG-IR-24-015 names FMWP signature HTTP.Chunk.Length.Invalid. (db update 24.020) as a temporary control on devices that still run SSL VPN.","limits":"Requires a FortiGuard IPS/AV subscription and a current FMWP pack. Interim only. Does not replace a first-fixed firmware and does not remove post-exploitation persistence.","verify":"FortiGuard IPS or AV signature lists show HTTP.Chunk.Length.Invalid. after FMWP db update 24.020 or later.","source":{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Disable SSL VPN or upgrade to a FG-IR-24-015 fixed release. If SSL VPN was ever enabled, Fortinet (10 Apr 2025) and CCCS AL25-005 say hunt the language-file symlink and reset credentials, then move to a cleanup build.","containment":[{"title":"Disable SSL VPN if you cannot patch immediately","detail":"FG-IR-24-015: disable SSL VPN. Disabling webmode is not valid. CISA KEV due 16 Feb 2024: apply vendor instructions or discontinue use if mitigations are unavailable.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-09","publisher":"CISA"}]},{"title":"Upgrade, then apply persistence cleanup if SSL VPN was ever enabled","detail":"Install a first-fixed RCE build from FG-IR-24-015. CCCS AL25-005 (14 Apr 2025) points to later cleanup builds 7.6.2, 7.4.7, 7.2.11, 7.0.17, and 6.4.16 after Fortinet documented a language-file symlink that can survive the original patch. CISA (11 Apr 2025) points to the Fortinet post-exploitation advisory. Fortinet: devices that never enabled SSL VPN are not impacted by that persistence issue.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities","date":"2025-04-11","publisher":"CISA"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}]},{"title":"Inspect SSL-VPN language-file folders for a symlink to the root filesystem","detail":"Fortinet (10 Apr 2025): a threat actor used known vulnerabilities including FG-IR-24-015, then created a symbolic link in SSL-VPN language files to keep read-only filesystem access after the original vector was locked down.","sources":[{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"}]}],"rotate":[{"item":"Local and remote credentials that the firewall or proxy could reach","reason":"CCCS AL25-005 tells operators to reset credentials after the persistent-access finding. Fortinet documented read-only filesystem access via the language-file symlink, which can expose configuration.","sources":[{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"}]}],"persistence":[{"kind":"path","value":"Symbolic link in SSL-VPN language-file folders pointing at the root filesystem","detail":"Post-exploitation persistence described by Fortinet on 10 Apr 2025 and echoed by CCCS AL25-005. Devices that never enabled SSL VPN are not impacted by that issue.","sourceUrl":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","sourceDate":"2025-04-10"}],"evidence":[{"title":"Keep IPS hits for HTTP.Chunk.Length.Invalid.","detail":"FG-IR-24-015 names this FortiGuard virtual-patch signature. Preserve FortiGate IPS/AV logs from 8 Feb 2024.","sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"}]},{"title":"Keep sslvpnd crash history","detail":"Assetnote analysis context includes sslvpnd instability around crafted chunked requests. The catalog page already records diagnose debug crashlog read as the appliance command.","sources":[{"url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","date":"2024-03-15","publisher":"Assetnote"}]},{"title":"Keep language-file folder listings and config revisions","detail":"Fortinet and CCCS: inspect language-file folders for a symlink. CCCS also recommends watching unauthorized SSL-VPN logins and config diffs.","sources":[{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}]}],"limits":["The original RCE patch does not remove the April 2025 language-file symlink.","No primary hash list is quoted here.","Devices that never sent IPS or crash logs off-box have no history after rotation."],"sources":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","publisher":"Fortinet"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-09","publisher":"CISA"},{"url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","publisher":"Fortinet"},{"url":"https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities","date":"2025-04-11","publisher":"CISA"},{"url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","publisher":"Canadian Centre for Cyber Security"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Fortinet","title":"FG-IR-24-015 Out-of-bound Write in sslvpnd","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","cve":"CVE-2024-21762"}],"coverage":[{"title":"FG-IR-24-015","publisher":"Fortinet","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08","type":"vendor","addedDate":"2026-10-24"},{"title":"Two Bytes is Plenty","publisher":"Assetnote","url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","date":"2024-03-15","type":"research","addedDate":"2026-10-24"},{"title":"Analysis of Threat Actor Activity","publisher":"Fortinet","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","date":"2025-04-10","type":"vendor","addedDate":"2026-10-24"},{"title":"CISA alert on Fortinet post-exploitation technique","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities","date":"2025-04-11","type":"government","addedDate":"2026-10-24"},{"title":"CCCS AL25-005","publisher":"Canadian Centre for Cyber Security","url":"https://www.cyber.gc.ca/en/alerts-advisories/compromise-persistent-access-fortinet-fortios-products-cve-2022-42475-cve-2023-27997-cve-2024-21762","date":"2025-04-14","type":"government","addedDate":"2026-10-24"}],"posts":[],"research":[{"title":"FG-IR-24-015","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","authors":"Fortinet PSIRT","date":"2024-02-08"},{"title":"Two Bytes is Plenty","url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","authors":"Assetnote / Searchlight Cyber","date":"2024-03-15"},{"title":"Analysis of Threat Actor Activity","url":"https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity","authors":"Fortinet","date":"2025-04-10"},{"title":"NVD CVE-2024-21762","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21762","authors":"NVD","date":"2024-02-09"}],"impact":{"kind":"single-product","product":"Fortinet FortiOS and FortiProxy (SSL VPN enabled)","versions":[{"version":"FortiOS 7.4","status":"affected","versions":">= 7.4.3","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.4.0 through 7.4.2"},"addedDate":"2026-10-24"},{"version":"FortiOS 7.2","status":"affected","versions":">= 7.2.7","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.2.0 through 7.2.6"},"addedDate":"2026-10-24"},{"version":"FortiOS 7.0","status":"affected","versions":">= 7.0.14","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.0.0 through 7.0.13"},"addedDate":"2026-10-24"},{"version":"FortiOS 6.4","status":"affected","versions":">= 6.4.15","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"6.4.0 through 6.4.14"},"addedDate":"2026-10-24"},{"version":"FortiOS 6.2","status":"affected","versions":">= 6.2.16","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"6.2.0 through 6.2.15"},"addedDate":"2026-10-24"},{"version":"FortiOS 6.0","status":"affected","versions":">= 6.0.18","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"6.0.0 through 6.0.17"},"addedDate":"2026-10-24"},{"version":"FortiProxy 7.4","status":"affected","versions":">= 7.4.3","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.4.0 through 7.4.2"},"addedDate":"2026-10-24"},{"version":"FortiProxy 7.2","status":"affected","versions":">= 7.2.9","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.2.0 through 7.2.8"},"addedDate":"2026-10-24"},{"version":"FortiProxy 7.0","status":"affected","versions":">= 7.0.15","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"7.0.0 through 7.0.14"},"addedDate":"2026-10-24"},{"version":"FortiProxy 2.0","status":"affected","versions":">= 2.0.14","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"2.0.0 through 2.0.13"},"addedDate":"2026-10-24"},{"version":"FortiProxy 1.2 / 1.1 / 1.0","status":"eol-migrate","versions":"Migrate to a fixed release","vendorStatement":{"date":"2024-02-08","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","quote":"Migrate to a fixed release"},"addedDate":"2026-10-24"}]},"pocs":[{"title":"Assetnote technical analysis (Two Bytes is Plenty)","url":"https://www.assetnote.io/resources/research/two-bytes-is-plenty-fortigate-rce-with-cve-2024-21762","source":"Assetnote / Searchlight Cyber","validationStatus":"validated","validationDate":"2024-03-15","notes":"Public technical analysis of a working chain against a specific 7.2.5 lab build. Listed for defender awareness. This site does not republish exploit code.","addedDate":"2026-10-24"}],"_feed":{"page":"https://vuln2shell.com/vulns/fortios-ssl-vpn","json":"https://vuln2shell.com/vulns/fortios-ssl-vpn.json","iocsCsv":"https://vuln2shell.com/vulns/fortios-ssl-vpn/iocs.csv","stix":"https://vuln2shell.com/vulns/fortios-ssl-vpn/stix.json"}}