CVEvulnerability

CVE-2024-23113

9.8 CRITICAL Known exploited Published 2024-02-15 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Fortinet Multiple Products Format String Vulnerability — Fortinet Multiple Products

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Added to KEV: 2024-10-09
Remediation due: 2024-10-30
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.fortiguard.com/psirt/FG-IR-24-029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-23113

Status: Analyzed
Published: 2024-02-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-134

Description

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected configurations

• fortinet fortiproxy (>= 7.0.0 <= 7.0.14) • fortinet fortiproxy (>= 7.2.0 <= 7.2.8) • fortinet fortiproxy (>= 7.4.0 <= 7.4.2) • fortinet fortiswitchmanager (>= 7.0.0 <= 7.0.3) • fortinet fortiswitchmanager (>= 7.2.0 <= 7.2.3) • fortinet fortios (>= 7.0.0 <= 7.0.13) • fortinet fortios (>= 7.2.0 <= 7.2.6) • fortinet fortios (>= 7.4.0 <= 7.4.2) • fortinet fortipam (>= 1.0.0 <= 1.0.3) • fortinet fortipam (>= 1.1.0 <= 1.1.2) • fortinet fortipam 1.2.0

Weakness · CWE (1)

CWE-134 Use of Externally-Controlled Format String weakness

References