---
id: "CVE-2024-23113"
kind: "vulnerability"
aliases: ["CVE-2024-23113"]
title: "A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6,\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Fortinet Multiple Products", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.0.0, <= 7.0.14", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.2.0, <= 7.2.8", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": [], "affected": ">= 7.4.0, <= 7.4.2", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": [], "affected": ">= 7.0.0, <= 7.0.3", "ecosystem": "vendor"}, {"name": "fortinet fortiswitchmanager", "fixed": [], "affected": ">= 7.2.0, <= 7.2.3", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.0.0, <= 7.0.13", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.2.0, <= 7.2.6", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": [], "affected": ">= 7.4.0, <= 7.4.2", "ecosystem": "vendor"}, {"name": "fortinet fortipam", "fixed": [], "affected": ">= 1.0.0, <= 1.0.3", "ecosystem": "vendor"}, {"name": "fortinet fortipam", "fixed": [], "affected": ">= 1.1.0, <= 1.1.2", "ecosystem": "vendor"}, {"name": "fortinet fortipam", "fixed": [], "affected": "= 1.2.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortios", "fortipam", "fortiproxy", "fortiweb", "infrastructure", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2024-02-15T14:15:46+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23113", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23113", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6,…

Fortinet FortiOS, FortiPAM, FortiProxy and FortiWeb contain a format string flaw in their management and request handling. A remote unauthenticated attacker can send crafted requests to execute arbitrary code or commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Fortinet Multiple Products affected ? fixed ?
- vendor:fortinet fortiproxy affected >= 7.0.0, <= 7.0.14 fixed ?
- vendor:fortinet fortiproxy affected >= 7.2.0, <= 7.2.8 fixed ?
- vendor:fortinet fortiproxy affected >= 7.4.0, <= 7.4.2 fixed ?
- vendor:fortinet fortiswitchmanager affected >= 7.0.0, <= 7.0.3 fixed ?
- vendor:fortinet fortiswitchmanager affected >= 7.2.0, <= 7.2.3 fixed ?
- vendor:fortinet fortios affected >= 7.0.0, <= 7.0.13 fixed ?
- vendor:fortinet fortios affected >= 7.2.0, <= 7.2.6 fixed ?
- vendor:fortinet fortios affected >= 7.4.0, <= 7.4.2 fixed ?
- vendor:fortinet fortipam affected >= 1.0.0, <= 1.0.3 fixed ?
- vendor:fortinet fortipam affected >= 1.1.0, <= 1.1.2 fixed ?
- vendor:fortinet fortipam affected = 1.2.0 fixed ?

## Fix

Apply the mitigation or fixed firmware per the Fortinet advisory; the sources do not name the versions. If no mitigation exists, stop using the affected product until it is patched.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-23113
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-23113

## From the sources

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_