{"id":"CVE-2024-23113","kind":"vulnerability","aliases":["CVE-2024-23113"],"related":[],"title":"A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6,…","description":"A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.","summary":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiWeb contain a format string flaw in their management and request handling. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the device.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-10-09T00:00:00+00:00","products":[{"name":"Fortinet Multiple Products","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.0.0, <= 7.0.14","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.2.0, <= 7.2.8","ecosystem":"vendor"},{"name":"fortinet fortiproxy","fixed":[],"affected":">= 7.4.0, <= 7.4.2","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":[],"affected":">= 7.0.0, <= 7.0.3","ecosystem":"vendor"},{"name":"fortinet fortiswitchmanager","fixed":[],"affected":">= 7.2.0, <= 7.2.3","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 7.0.0, <= 7.0.13","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 7.2.0, <= 7.2.6","ecosystem":"vendor"},{"name":"fortinet fortios","fixed":[],"affected":">= 7.4.0, <= 7.4.2","ecosystem":"vendor"},{"name":"fortinet fortipam","fixed":[],"affected":">= 1.0.0, <= 1.0.3","ecosystem":"vendor"},{"name":"fortinet fortipam","fixed":[],"affected":">= 1.1.0, <= 1.1.2","ecosystem":"vendor"},{"name":"fortinet fortipam","fixed":[],"affected":"= 1.2.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","fortios","fortipam","fortiproxy","fortiweb","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigation or fixed firmware per the Fortinet advisory; the sources do not name the versions. If no mitigation exists, stop using the affected product until it is patched.","status":"open","published_at":"2024-02-15T14:15:46+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:56:28+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T20:56:28Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigation or fixed firmware per the Fortinet advisory; the sources do not name the versions. If no mitigation exists, stop using the affected product until it is patched.","reach":"internet","impact":"high","summary":"Fortinet FortiOS, FortiPAM, FortiProxy and FortiWeb contain a format string flaw in their management and request handling. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the device.","category":"infrastructure","who_cares":["fortios","fortipam","fortiproxy","fortiweb","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary code or commands on the appliance remotely.","analyst_note":"Find the Fortinet PSIRT advisory for CVE-2024-23113 to get affected and fixed versions, the mitigation steps, and a check for compromise indicators; the sources here give none.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000486,"input_tokens":2842,"output_tokens":403,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-23113':21A,24A '1.0.0':131C '1.0.3':133C '1.1.0':128C '1.1.2':130C '1.2.0':127C '7.0.0':111C,122C,139C '7.0.13':113C '7.0.14':124C '7.0.3':141C '7.2.0':16A,108C,119C,136C '7.2.3':138C '7.2.6':18A,110C '7.2.8':121C '7.4.0':13A,105C,116C '7.4.2':15A,107C,118C 'allow':142C 'arbitrari':86B 'attack':79B,143C 'code':87B,147C 'command':89B,149C 'contain':65B 'control':6A,98C 'craft':82B,152C 'cve':19A,22A 'devic':92B 'execut':85B,145C 'exploit':50B 'extern':5A,97C 'externally-control':4A,96C 'flaw':69B 'format':7A,67B,99C 'fortinet':10A,25A,28A,30A,32A,34A,36A,38A,40A,42A,44A,46A,48A,59B,102C 'fortio':11A,51B,60B,103C 'fortios':39A,41A,43A 'fortipam':45A,47A,49A,52B,61B,125C 'fortiproxi':53B,62B,114C 'fortiproxy':29A,31A,33A 'fortiswitchmanag':134C 'fortiswitchmanager':35A,37A 'fortiweb':54B,64B 'handl':75B 'host':58B 'infrastructur':55B 'manag':72B 'multiple':26A 'packet':153C 'products':27A 'remot':77B 'request':74B,83B 'self':57B 'self-host':56B 'send':81B 'special':151C 'string':8A,68B,100C 'unauthent':78B 'unauthor':146C 'use':2A,94C 'version':12A,104C,115C,126C,135C 'via':150C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-02-15T14:15:46+00:00","kev":{"dateAdded":"2024-10-09","dueDate":"2024-10-30","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-23113","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23113","severity":null,"published_at":"2024-10-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-23113","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23113","severity":null,"published_at":"2024-02-15T14:15:46+00:00","modified_at":"2026-06-17T07:12:03+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}