Fortinet FortiOS: SSL-VPN out-of-bounds write

Impact

SSL-VPN out-of-bounds write -> unauthenticated remote code execution

Who can reach it

Network (remote)

What to do

Control-plane: emergency firmware; rotate all VPN user credentials

References

Related entries

• Fortinet FortiOS: SSL-VPN heap-based buffer overflowCVE-2022-42475 · Fortinet FortiOSCritical
• NetApp ONTAP Select Deploy administration utility (hard-coded credentials): Baked-in credentials let an attacker readCVE-2024-21990 · NetApp ONTAP Select Deploy administration utility (hard-coded credentials)Critical
• HPE Cray Parallel Application Launch Service (PALS) authentication bypass: Authentication bypass in the serviceCVE-2024-22441 · HPE Cray Parallel Application Launch Service (PALS) authentication bypassCritical
• Jenkins: CLI parser expands `@file` into argument contentsCVE-2024-23897 · JenkinsCritical
• LenelS2 NetBox access control and event monitoring system (<=5.6.1): Unauthenticated remote code executionCVE-2024-2421 · LenelS2 NetBox access control and event monitoring system (<=5.6.1)Critical
• JetBrains TeamCity: Alternative-path authentication bypassCVE-2024-27198 · JetBrains TeamCityCritical