CVE-2024-23113

Description

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

References

https://www.infosecurity-magazine.com/news/watchtowr-new-vulnerability/

https://thehackernews.com/2024/10/cisa-adds-sciencelogic-sl1.html

https://www.hipaajournal.com/exploitation-fortinet-veeam-backup-replication-vulnerabilities/

https://www.theregister.com/2024/10/14/fortinet_vulnerability/

https://thehackernews.com/2024/10/cisa-warns-of-critical-fortinet-flaw-as.html

https://securityaffairs.com/169619/security/u-s-cisa-adds-ivanti-csa-and-fortinet-bugs-to-its-known-exploited-vulnerabilities-catalog.html

https://www.bleepingcomputer.com/news/security/cisa-says-critical-fortinet-rce-flaw-now-exploited-in-attacks/

https://www.tenable.com/blog/cve-2024-21762-critical-fortinet-fortios-out-of-bound-write-ssl-vpn-vulnerability

https://fortiguard.com/psirt/FG-IR-24-029

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3