{"id":"CVE-2024-23113","published":"2024-02-15T14:15:46Z","modified":"2026-06-17T07:12:03Z","title":"Fortinet Multiple Products Format String Vulnerability","vendor":"Fortinet","product":"Multiple Products","tier":"core","eol":null,"description":{"text":"A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a use of externally-controlled format string in Fortinet's multiple products, affecting FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager across the version ranges listed in the advisory. An attacker who sends specially crafted packets to an affected system can execute unauthorized code or commands, with the attack requiring no authentication or user interaction and only network reachability to the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:05Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.61725,"percentile":0.99169,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-10-09","dueDate":"2024-10-30","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.fortiguard.com/psirt/FG-IR-24-029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-23113","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-10-09","exploitedFirstSeen":"2024-10-09","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-10-09"},{"url":"https://www.cert.govt.nz/advisories/rce-vulnerability-affecting-fortinet-products/","date":"2024-10-17"},{"url":"https://x.com/mattjay/status/1857183112662520252","date":"2024-11-14"},{"url":"https://www4.orangecyberdefense.com/security-navigator-2025-en","date":"2024-12-05"},{"url":"https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/67b5c5f85bac8f34e1b44d35_Darktrace%20Annual%20Threat%20Report%202024.pdf","date":"2025-02-19"},{"url":"https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf","date":"2025-02-21"},{"url":"https://www.tenable.com/blog/verizon-2025-dbir-tenable-research-collaboration","date":"2025-04-23"},{"url":"https://www.verizon.com/business/resources/T32e/reports/2025-dbir-data-breach-investigations-report.pdf","date":"2025-04-25"},{"url":"https://3354902.hs-sites.com/hubfs/Consulting/TTP%20Briefing/Cybereason_TTP_Briefing_Q3-2025.pdf","date":"2025-10-23"},{"url":"https://ctrlaltintel.com/threat%20research/MuddyWater/","date":"2026-03-04"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-134","name":"Use of Externally-Controlled Format String"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-029","tags":["Vendor Advisory"]},{"url":"https://fortiguard.com/psirt/FG-IR-24-029","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-exploitable via crafted packets to public-facing devices","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows attacker to execute unauthorized code or commands via specially crafted packets","start":358,"end":444}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Format string flaw yields unauthorized code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows attacker to execute unauthorized code or commands via specially crafted packets","start":358,"end":444}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2024-23113 - Fortinet FortiOS RCE","start":4477,"end":4514},{"quote":"We observed the threat actor target multiple Fortinet related CVEs (CVE-2024-55591, CVE-2024-23113 & CVE-2022-42475) in attempts to gain command execution on Edge devices.","start":6650,"end":6821}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-20638","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20638","exploited":true,"exploitedSince":"2024-10-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2024-10-11","earliestUrl":"https://github.com/CheckCve2/CVE-2024-23113","repos":[{"name":"p33d/CVE-2024-23113","url":"https://github.com/p33d/CVE-2024-23113","stars":11,"created":"2024-10-21"},{"name":"CheckCve2/CVE-2024-23113","url":"https://github.com/CheckCve2/CVE-2024-23113","stars":1,"created":"2024-10-11"},{"name":"puckiestyle/CVE-2024-23113","url":"https://github.com/puckiestyle/CVE-2024-23113","stars":1,"created":"2024-10-31"},{"name":"MAVRICK-1/cve-2024-23113-test-env","url":"https://github.com/MAVRICK-1/cve-2024-23113-test-env","stars":1,"created":"2025-07-02"},{"name":"ownouwa/cve-2024-23113-poc","url":"https://github.com/ownouwa/cve-2024-23113-poc","stars":0,"created":"2025-03-20"}]},"first":{"date":"2024-10-11","source":"PoC-in-GitHub","url":"https://github.com/CheckCve2/CVE-2024-23113"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2024-02-15","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23113","provenance":"source"},{"date":"2024-10-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2024-10-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-10-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20638","provenance":"source"},{"date":"2024-10-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/CheckCve2/CVE-2024-23113","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":239,"firstExploitFrom":"PoC-in-GitHub","daysToKev":237},"priority":{"score":73.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 751 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9917"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}