Live › vulnerability › CVE-2024-23113
Go to dashboardFortinet FortiOS, FortiPAM, FortiProxy and FortiWeb contain a format string flaw in their management and request handling. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Fortinet Multiple Products | vendor | – | – |
| fortinet fortiproxy | vendor | >= 7.0.0, <= 7.0.14 | – |
| fortinet fortiproxy | vendor | >= 7.2.0, <= 7.2.8 | – |
| fortinet fortiproxy | vendor | >= 7.4.0, <= 7.4.2 | – |
| fortinet fortiswitchmanager | vendor | >= 7.0.0, <= 7.0.3 | – |
| fortinet fortiswitchmanager | vendor | >= 7.2.0, <= 7.2.3 | – |
| fortinet fortios | vendor | >= 7.0.0, <= 7.0.13 | – |
| fortinet fortios | vendor | >= 7.2.0, <= 7.2.6 | – |
| fortinet fortios | vendor | >= 7.4.0, <= 7.4.2 | – |
| fortinet fortipam | vendor | >= 1.0.0, <= 1.0.3 | – |
| fortinet fortipam | vendor | >= 1.1.0, <= 1.1.2 | – |
| fortinet fortipam | vendor | = 1.2.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
This page as .md · .json · in your agent: get_signal("CVE-2024-23113")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.