CVE-2024-23113
CRITICAL KEVFortinet Fortiproxy < 7.0.14 - Format String Vulnerability
Title source: ruleDescription
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
Exploits (8)
github
WORKING POC
2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2024/CVE-2024-23113
Scores
CVSS v3
9.8
EPSS
0.5748
EPSS Percentile
98.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
CISA KEV
2024-10-09
VulnCheck KEV
2024-10-09
InTheWild.io
2024-10-09
ENISA EUVD
EUVD-2024-20638
Classification
CWE
CWE-134
Status
published
Affected Products (5)
fortinet/fortiproxy
< 7.0.14
fortinet/fortiswitchmanager
< 7.0.3
fortinet/fortios
< 7.0.13
fortinet/fortipam
< 1.0.3
fortinet/fortipam
Timeline
Published
Feb 15, 2024
KEV Added
Oct 09, 2024
Tracked Since
Feb 18, 2026