FortiOS SSL VPN: three exploited CVEs and the fix

CVE-2018-13379: the SSL VPN portal let anyone read system files without logging in, including the file with the VPN users' credentials. NVD scores it 9.8.

Then CVE-2022-42475 and CVE-2024-21762: code execution on the firewall itself, again without logging in, 9.8 each. Both entered CISA's catalog one day after Fortinet's advisory.

The attacker needs to reach the SSL VPN portal, and a VPN portal is meant to be reachable from anywhere. No account. Low complexity. Nobody inside has to click anything.

Requests from the Internet reach the VPN portal. The first flaw lets files out, credentials included. The later ones let code run on the gateway itself.

Either way, the attacker ends up inside, logging in as your own users.

VPN credentials exposed, and attackers logging in as real users. Code running on the firewall.

And in 2025, Fortinet and CISA reported a further twist: on devices that had been compromised, a hidden link kept read only access to files even after patching. Patched is not the same as clean.

Upgrade FortiOS to a fixed release, and for the 2025 issue, to 7.6.2, 7.4.7, 7.2.11, 7.0.17 or 6.4.16, or later.

If you cannot patch yet, disable SSL VPN entirely: for CVE-2024-21762, Fortinet says turning off web mode alone is not enough.

Then reset every VPN password, turn on two-factor authentication, and review the configuration.

NacTrack reads each FortiGate's version and matches it against the published advisories, with CISA's known exploited flag.

Sources: CISA KEV, Fortinet PSIRT (FG-IR-18-384, 22-398, 24-015), NVD, CISA.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.