# Ground Hog Day: Fortinet VPN Edition

- Link: https://www.agilicus.com/ground-hog-day-fortinet-vpn-edition/
- Published: 2024-02-09T17:23:34+00:00
- Author: Don Bowman

So its a few days after ground hog day. Side note: I once explained this tradition
to a UK colleague and he thought I was putting him on. Chris C, this one is for 
you!

Ground hog day is famously about prognisticating rodents predicting the weather.
But, its also a famous movie with Bill Murray where the time resets each morning
and he relives the same day again and again.

Today we got the cheerful news that [CVE-2024-21762](https://nvd.nist.gov/vuln/detail/CVE-2024-21762)
from Fortinet (as **[FG-IR-24-015](https://www.fortiguard.com/psirt/FG-IR-24-015)**)
your VPN is once again letting it all flap in the breeze with a CVSS score: 9.6.
Yes, you and your 9B best friends can now execute arbitrary commands (and new binaries!)
on your key security appliance.

The Rust fans are all spinning this as yet another I told you so regarding out-of-
bounds writing issue, in this case for inbound HTTP requests with some hanky-panky
inside. I won’t link it, but there is an exploit available, meaning anyone with 
a device made in the last 20 years and the ability to type the or speak something
to Google can find it. So obscurity security will not play here. National security
agencies have already warned of this being [actively exploited](https://www.csa.gov.sg/alerts-advisories/alerts/2024/al-2024-016).

Above I used the metaphor Ground Hog day, because we just went through this with
e.g. [Ivanti](https://www.agilicus.com/vpns-in-industrial-environments-old-yeller/).
There I used the metaphor of Ole Yeller and shooting an old friend. Yes, Metaphors
are my New Years resolution, Simile’s are so 2023.

So, what to do? Patch early, patch often? Maybe its time to invest in some Defence
In Depth. Your VPN needs a firewall on each side, ideally by different vendors. 
Or, you need them in series, 2 VPN. Another approach, which I recommend, is adopting
a Zero Trust strategy, so its not all or nothing, its one piece at a time (queue
Johnny Cash).