What’s Vulnerable › Vulnerabilities

CVE-2024-23113: Fortinet Multiple Products Format String Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-10-09
• EPSS: 61.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-15 · updated 2026-06-17
• Weakness: CWE-134

Description

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Summary

CVE-2024-23113 is a critical (CVSS 9.8) format string vulnerability in Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager that lets an attacker execute unauthorized code or commands via specially crafted packets. Affected versions include FortiOS 7.4.0-7.4.2, 7.2.0-7.2.6 and 7.0.0-7.0.13, FortiProxy 7.4.0-7.4.2, 7.2.0-7.2.8 and 7.0.0-7.0.14, FortiPAM 1.2.0, 1.1.0-1.1.2 and 1.0.0-1.0.3, and FortiSwitchManager 7.2.0-7.2.3 and 7.0.0-7.0.3. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 61.7% chance of exploitation in 30 days. Apply the mitigations in Fortinet's vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2024-23113 ثغرة حرجة (CVSS 9.8) من نوع format string في منتجات Fortinet FortiOS وFortiProxy وFortiPAM وFortiSwitchManager، وتتيح للمهاجم تنفيذ تعليمات برمجية أو أوامر غير مصرّح بها عبر حزم مُصمَّمة خصيصاً. تشمل الإصدارات المتأثرة FortiOS 7.4.0-7.4.2 و7.2.0-7.2.6 و7.0.0-7.0.13، وFortiProxy 7.4.0-7.4.2 و7.2.0-7.2.8 و7.0.0-7.0.14، وFortiPAM 1.2.0 و1.1.0-1.1.2 و1.0.0-1.0.3، وFortiSwitchManager 7.2.0-7.2.3 و7.0.0-7.0.3. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة باستغلالها مع استغلال نشط، ويقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 61.7%. طبّق التخفيفات الواردة في تعليمات المورّد أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Fortinet FortiOS (FortiGate): from 7.0.0 through 7.0.13; from 7.2.0 through 7.2.6; from 7.4.0 through 7.4.2
• Fortinet FortiPAM: from 1.0.0 through 1.0.3; from 1.1.0 through 1.1.2; 1.2.0
• Fortinet FortiProxy: from 7.0.0 through 7.0.14; from 7.2.0 through 7.2.8; from 7.4.0 through 7.4.2
• Fortinet FortiSwitchManager: from 7.0.0 through 7.0.3; from 7.2.0 through 7.2.3

References

• https://fortiguard.com/psirt/FG-IR-24-029
• https://fortiguard.com/psirt/FG-IR-24-029
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113

Get alerted when CVE-2024-23113 or the next vulnerability affects your stack