Fortinet · Multiple Products
CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability
What it is
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
CISA: Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 30, 2024
- Added to the CISA list
- October 9, 2024
- Published
- February 15, 2024
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 62% in the top 0.8% of all known vulnerabilities
- Weakness
- CWE-134
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Fortinet
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 16, 2026 | Path Traversal | Multiple Products | Medium 5.4 | 1.3% |
| Sep 9, 2026 | Heap-based Buffer Overflow | Multiple Products | High 7.4 | 3.7% |
| Jan 27, 2026 | Authentication Bypass Using an Alternate Path or Channel | Multiple Products | Critical 9.4 | 87% |
| Dec 16, 2025 | Improper Verification of Cryptographic Signature | Multiple Products | Critical 9.1 | 68% |
| May 14, 2025 | Stack-Based Buffer Overflow | Multiple Products | Critical 9.6 | 31% |
| Oct 11, 2022 | Authentication Bypass | Multiple Products | Critical 9.8 | >99.9% |
| Oct 1, 2026 | Path Traversal | FortiMail | Critical 9.8 | 4.6% |
| Jul 27, 2026 | Exposure of Sensitive Information to an Unauthorized Actor | FortiOS | Medium 5.3 | 29% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.