PT-2024-1569 · Fortinet · Fortiswitchmanager+3

Published 2024-02-08 · Updated 2026-03-06 · CVE-2024-23113

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Fortinet FortiOS versions 7.0.0 through 7.0.13 Fortinet FortiOS versions 7.2.0 through 7.2.6 Fortinet FortiOS versions 7.4.0 through 7.4.2 FortiProxy versions 7.0.0 through 7.0.14 FortiProxy versions 7.2.0 through 7.2.8 FortiProxy versions 7.4.0 through 7.4.2 FortiPAM versions 1.0.0 through 1.0.3 FortiPAM versions 1.1.0 through 1.1.2 FortiPAM version 1.2.0 FortiSwitchManager versions 7.0.0 through 7.0.3 FortiSwitchManager versions 7.2.0 through 7.2.3

Description A use of externally-controlled format string vulnerability in Fortinet FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted requests. This issue affects multiple Fortinet products, including FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager. The vulnerability is being actively exploited in the wild, with over 87,000 devices potentially at risk. It is recommended to upgrade to patched versions immediately to mitigate the risk of remote code execution attacks.

Recommendations Upgrade Fortinet FortiOS versions 7.0.0 through 7.0.13 to version 7.0.14 or above Upgrade Fortinet FortiOS versions 7.2.0 through 7.2.6 to version 7.2.7 or above Upgrade Fortinet FortiOS versions 7.4.0 through 7.4.2 to version 7.4.3 or above Upgrade FortiProxy versions 7.0.0 through 7.0.14 to a patched version Upgrade FortiProxy versions 7.2.0 through 7.2.8 to a patched version Upgrade FortiProxy versions 7.4.0 through 7.4.2 to a patched version Upgrade FortiPAM versions 1.0.0 through 1.0.3 to a patched version Upgrade FortiPAM versions 1.1.0 through 1.1.2 to a patched version Upgrade FortiPAM version 1.2.0 to a patched version Upgrade FortiSwitchManager versions 7.0.0 through 7.0.3 to a patched version Upgrade FortiSwitchManager versions 7.2.0 through 7.2.3 to a patched version As a temporary workaround, consider restricting access to the vulnerable module or function until a patch is available.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2024-01122

CVE-2024-23113

FORTIOSFGFM_CVE2024_23113

Affected Products

Fortios

Fortipam

Fortiproxy

Fortiswitchmanager

References · 178

• 🔥 https://github.com/p33d/CVE-2024-23113 · Exploit
• 🔥 https://github.com/maybelookis/CVE-2024-23113 · Exploit
• 🔥 https://github.com/HazeLook/CVE-2024-23113 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-23113-poc · Exploit
• 🔥 https://github.com/expl0itsecurity/CVE-2024-23113 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-23113-exp · Exploit
• 🔥 https://github.com/CheckCve2/CVE-2024-23113 · Exploit
• 🔥❌ https://github.com/tr1pl3ight/CVE-2024-23113-POC · Exploit, Deleted
• 🔥❌ https://github.com/foxymoxxy/CVE-2024-23113-POC · Exploit, Deleted
• https://safe-surf.ru/specialists/bulletins-nkcki/705880 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2024-02-09.1.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-23113 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/705083 · Security Note
• https://bdu.fstec.ru/vul/2024-01122 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23113 · Security Note