by Kastro
Paper/Archive/CVE-2024-23113

CVE-2024-23113

Fortinet FortiSwitchManager — Fortinet Multiple Products Format String Vulnerability

KEV · due 30 OctEPSS 62%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.2.992 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected

ProductAffectedFixed inSource
FortiSwitchManager7.2.0 – 7.2.3–CNA
FortiSwitchManager7.0.0 – 7.0.3–CNA
FortiOS7.4.0 – 7.4.2–CNA
FortiOS7.2.0 – 7.2.6–CNA
FortiOS7.0.0 – 7.0.13–CNA
FortiPAM1.2.0–CNA
FortiPAM1.1.0 – 1.1.2–CNA
FortiPAM1.0.0 – 1.0.3–CNA
FortiProxy7.4.0 – 7.4.2–CNA
FortiProxy7.2.0 – 7.2.8–CNA
FortiProxy7.0.0 – 7.0.15–CNA
fortiswitchmanager7.2.0 – 7.2.3–CISA-ADP

Scores by source

fortinet (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-24-029refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113kevcisa.gov/known-exploited-vulnerabilities-catalog