← Back to browse · API

CVE-2024-23113

Severity
CRITICAL
CVSS
9.8
EPSS
0.61725
Risk score
85.8
CISA KEV
Yes
PoC
No
Published
2024-10-09
Modified
2024-10-09
First seen
2026-08-07
Aliases
EUVD-2024-20638, GHSA-57PF-F69P-P222
Products
Fortinet:FortiOS 7.0.0 ≤7.0.13, Fortinet:FortiOS 7.2.0 ≤7.2.6, Fortinet:FortiOS 7.4.0 ≤7.4.2, Fortinet:FortiPAM 1.0.0 ≤1.0.3, Fortinet:FortiPAM 1.1.0 ≤1.1.2, Fortinet:FortiPAM 1.2.0, Fortinet:FortiProxy 7.0.0 ≤7.0.15, Fortinet:FortiProxy 7.2.0 ≤7.2.8, Fortinet:FortiProxy 7.4.0 ≤7.4.2, Fortinet:FortiSwitchManager 7.0.0 ≤7.0.3, Fortinet:FortiSwitchManager 7.2.0 ≤7.2.3, Fortinet:Multiple Products
Sources
euvd EUVD-2024-20638
cisa.gov CVE-2024-23113

Description

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

References