There is no official patch for Rejetto HFS 2.x against CVE-2024-23692. Rejetto warns that HFS 2.3–2.4 is dangerous and recommends considering HFS 3. If you cannot migrate to a supported version or apply a vendor mitigation, discontinue the vulnerable service. Because stopping HFS does not establish whether a host was compromised or remove persistence, treat a suspected intrusion as an incident-response matter.
Which Rejetto HFS versions are affected?
CVE-2024-23692 affects the legacy HFS 2.x branch. The vulnerability is in its template engine: a specially crafted HTTP request can lead to remote command execution without authentication. The Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog on July 9, 2024, citing evidence of active exploitation. CISA’s KEV catalog describes the issue and its remediation action.
As an Amazon Associate I earn from qualifying purchases.
Rejetto’s site identifies HFS 2.3–2.4 as dangerous, while its HFS 2 download page lists 2.4.0 RC7 as the latest version and says there is no known fix. DIVD describes the affected range as HFS 2.3x through 2.4 RC07. These version descriptions point to the legacy 2.x line; they should not be read as a claim that every HFS release is affected.
Is there a patch for HFS 2?
No official HFS 2 fix is available for this vulnerability, according to Rejetto. Its HFS site says version 2.3–2.4 should no longer be used and recommends considering HFS 3. The HFS 2 download page likewise warns that HFS 2.x has no known fix.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
A community forum post described disabling macros as a temporary workaround, with reduced functionality and changes to normal template behavior. That is not an official patch or a supported resolution, and it does not replace migrating away from the vulnerable branch or discontinuing its use. The forum notice characterizes the measure as temporary.
What should you do instead?
Migrate to a supported version
Rejetto points users toward HFS 3, and DIVD also advises migration to supported version 3.x. Rejetto says HFS 3 is not affected by CVE-2024-23692. That is a statement about this specific vulnerability, not a guarantee that HFS 3 has no security issues. Check the current HFS 3 release and security information before deploying it, and plan the migration around your configuration, access controls, and file-sharing workflow.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
Discontinue HFS 2 if migration is not available
CISA’s KEV catalog directs organizations to apply vendor mitigations or discontinue use if mitigations are unavailable. Since Rejetto says there is no official HFS 2 fix, an organization unable to move to a supported version should stop offering the vulnerable service rather than treat a workaround as a patch. Discontinuing the service addresses exposure from that running application; it does not prove the host was never compromised or remove any attacker access that may already exist.
How do you remove HFS safely?
There is no single uninstall sequence established for every HFS installation. The right procedure depends on how it was installed and run, the operating system, and any service, startup, firewall, share, or configuration changes made on that host. Use the relevant operating-system documentation and your organization’s change-control process to identify and remove those components. Do not assume that deleting an application folder alone disables every way it could start or removes related access.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
If the server may have been exposed while running the vulnerable version, follow current, environment-specific incident-response guidance. Preserve evidence as required by your organization, investigate the host and its access paths, and involve your security or incident-response team. The available vendor and government guidance does not provide a complete host investigation or recovery checklist, so a generic uninstall recipe cannot establish that a potentially compromised system is clean.
Quick Recap
What the guidance does—and does not—establish
- Established: HFS 2.3–2.4 is considered dangerous by Rejetto, and Rejetto says no official HFS 2 fix exists for this issue.
- Established: CVE-2024-23692 is a remotely exploitable, unauthenticated command-execution vulnerability, and CISA lists it as exploited.
- Not established: Whether a particular HFS host was compromised, whether a local workaround is effective for a specific deployment, or whether deleting files alone completes removal.
- Separate issue: HFS 3 is outside the scope of CVE-2024-23692, but that does not mean every HFS 3 release is free of other vulnerabilities. Verify current security status before migration.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
