{"id":"CVE-2024-23109","published":"2024-02-05T13:26:02Z","modified":"2026-01-14T13:47:28Z","title":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSIEM","versions":["7.1.1",">= 7.0.0, <= 7.0.2",">= 6.7.0, <= 6.7.8",">= 6.6.0, <= 6.6.3",">= 6.5.0, <= 6.5.2",">= 6.4.0, <= 6.4.3"]}],"description":{"text":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet  allows attacker to execute unauthorized code or commands via via crafted API requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an OS command injection vulnerability (improper neutralization of special elements used in an OS command) in Fortinet's FortiSIEM product. An attacker can execute unauthorized code or commands by sending crafted API requests, and the attack vector indicates this is reachable over the network with low complexity, requiring no privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:46Z"},"cvss":{"score":9.7,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03293,"percentile":0.88497,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-02-25","exploitedFirstSeen":"2025-02-25","ransomware":true,"evidence":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","date":"2025-02-25"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf","date":"2025-04-08"},{"url":"https://hunt.io/blog/keyplug-server-exposes-fortinet-exploits-webshells","date":"2025-04-17"},{"url":"https://asec.ahnlab.com/en/88063/","date":"2025-05-16"},{"url":"https://asec.ahnlab.com/ko/87992/","date":"2025-05-16"},{"url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025","date":"2025-08-21"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-130","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-20634","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20634","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-23109","provenance":"source"},{"date":"2025-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":69.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 614 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":17.7,"detail":"percentile 0.8850"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.79,"detail":"base score 9.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}