{"schemaVersion":3,"id":"CVE-2024-23113","aliases":[],"status":"published","duplicateOf":null,"title":"Fortinet Multiple Products Format String Vulnerability","description":"A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.","dates":{"published":"2024-02-15T13:59:25.313Z","modified":"2025-10-21T23:05:24.308Z","reserved":null,"kevAdded":["2024-10-09T00:00:00.000Z"],"kevDue":["2024-10-30T00:00:00.000Z"]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.61725,"percentile":0.99166,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.61725},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.61725,"percentile":0.99166}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.61725,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.61725,"percentile":0.99166}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-10-09T00:00:00.000Z","dueDate":"2024-10-30T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Fortinet Multiple Products Format String Vulnerability","description":"Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-24-029","label":"www.fortiguard.com/psirt/FG-IR-24-029"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2024-23113","label":"nvd.nist.gov/vuln/detail/CVE-2024-23113"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-10-09T00:00:00.000Z","dueDate":"2024-10-30T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Fortinet Multiple Products Format String Vulnerability","description":"Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.","notes":[{"type":"url","href":"https://www.fortiguard.com/psirt/FG-IR-24-029","label":"www.fortiguard.com/psirt/FG-IR-24-029"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2024-23113","label":"nvd.nist.gov/vuln/detail/CVE-2024-23113"}],"vendor":"Fortinet","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-134","name":"Use of Externally-Controlled Format String","description":"The product uses a function that accepts a format string as an argument, but the format string originates from an external source.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/134.html"}],"affected":[{"vendor":"fortinet","product":"fortios","name":"fortios","label":"fortios","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.0.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, ≤ 7.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.0.13 | ≥ 7.2.0, ≤ 7.2.6 | ≥ 7.4.0, ≤ 7.4.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"fortios","label":"FortiOS","category":"os"}},"hubHref":"/vendor/fortinet/fortios"},{"vendor":"fortinet","product":"fortipam","name":"fortipam","label":"fortipam","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 1.0.0, ≤ 1.0.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 1.1.0, ≤ 1.1.2","noFixRecorded":false,"fixedIn":null},{"text":"1.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.0.0, ≤ 1.0.3 | ≥ 1.1.0, ≤ 1.1.2 | 1.2.0","eol":null,"hubHref":"/vendor/fortinet/fortipam"},{"vendor":"fortinet","product":"fortiproxy","name":"fortiproxy","label":"fortiproxy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.0.15","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, ≤ 7.0.14","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.8","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.4.0, ≤ 7.4.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.0.15 | ≥ 7.0.0, ≤ 7.0.14 | ≥ 7.2.0, ≤ 7.2.8 | ≥ 7.4.0, ≤ 7.4.2","eol":null,"hubHref":"/vendor/fortinet/fortiproxy"},{"vendor":"fortinet","product":"fortiswitchmanager","name":"fortiswitchmanager","label":"fortiswitchmanager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 7.0.0, ≤ 7.0.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.2.0, ≤ 7.2.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.0.0, ≤ 7.0.3 | ≥ 7.2.0, ≤ 7.2.3","eol":null,"hubHref":"/vendor/fortinet/fortiswitchmanager"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-029","label":"fortiguard.com/psirt/FG-IR-24-029","hostname":"fortiguard.com","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-02-15T13:59:25.313Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2024-10-09T00:00:00.000Z","label":"Added to CISA KEV","detail":"Fortinet Multiple Products Format String Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2024-10-30T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:05:24.308Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T14:58:22.035Z","stale":false,"partial":false}}