CVE-2024-23113

The attacker sends specially crafted network packets to the vulnerable Fortinet device, in which malicious data reaches the string formatting function (format string) without proper validation. Since the attacker controls the format string, they can force the application to read or write arbitrary memory areas. This results in the ability to execute arbitrary code or system commands with the privileges of the target process.

An unauthenticated attacker can remotely take full control of the device — obtain sensitive data, modify configuration, and cause service unavailability (full CIA triad: confidentiality, integrity, availability at HIGH level).

Patches available from the vendor must be applied immediately according to references — detailed information about patched versions is available at https://fortiguard.com/psirt/FG-IR-24-029. Due to active exploitation of the vulnerability, the update should be performed urgently.

FortiOS 7.4.0–7.4.2, 7.2.0–7.2.6, 7.0.0–7.0.13; FortiProxy 7.4.0–7.4.2, 7.2.0–7.2.8, 7.0.0–7.0.14; FortiPAM 1.2.0, 1.1.0–1.1.2, 1.0.0–1.0.3; FortiSwitchManager 7.2.0–7.2.3, 7.0.0–7.0.3

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.