CVE-2024-23113
CRITICAL KEVFortinet Fortiproxy < 7.0.14 - Format String Vulnerability
Title source: ruleDescription
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.
Exploits (8)
github
WORKING POC
2 stars
by adminlove520 · pythonpoc
https://github.com/adminlove520/CVE-Poc_All_in_One/tree/main/2024/CVE-2024-23113
Scores
CVSS v3
9.8
EPSS
0.5803
EPSS Percentile
98.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CISA KEV
2024-10-09
VulnCheck KEV
2024-10-09
InTheWild.io
2024-10-09
ENISA EUVD
EUVD-2024-20638
CWE
CWE-134
Status
published
Products (5)
fortinet/fortios
7.0.0 - 7.0.13
fortinet/fortipam
1.2.0
fortinet/fortipam
1.0.0 - 1.0.3
fortinet/fortiproxy
7.0.0 - 7.0.14
fortinet/fortiswitchmanager
7.0.0 - 7.0.3
Published
Feb 15, 2024
KEV Added
Oct 09, 2024
Tracked Since
Feb 18, 2026