CVE-2023-34992

—

CVSS 3.1

9.8 critical

EPSS

80%p100

Published

Oct 10, 2023 (Oct 10, 2023)

Modified

Jun 17, 2026

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.

Vendors: fortinet
Products: fortisiem
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (80.1%)

In the news7 stories

Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256)

Help Net SecurityAug 18, 10:08 UTC · Aug 18, 2025Vulnerability in the wildCVE-2025-25256 CVE-2023-34992 CVE-2024-23108

Week in review: Attackers trying to access Check Point VPNs, NIST CSF 2.0 security metrics evolution

Help Net SecurityJun 2, 00:00 UTC · Jun 2, 2024Ransomware CVE-2024-24919 CVE-2024-23108 CVE-2023-34992

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

The Hacker NewsMay 29, 12:58 UTC · May 29, 2024Vulnerability CVE-2024-20252 CVE-2024-20254 CVE-2024-20255+9 CVEs

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

Help Net SecurityMay 29, 00:00 UTC · May 29, 2024Exploit / PoC CVE-2024-23108 CVE-2023-34992 CVE-2024-23109

CVE-2023-34992

In the news7 stories

Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256)

Week in review: Attackers trying to access Check Point VPNs, NIST CSF 2.0 security metrics evolution

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

Fortinet addressed two critical FortiSIEM vulnerabilities

CISA Adds Three Security Flaws with Active Exploitation to KEV Catalog

A critical OS command injection flaw affects Fortinet FortiSIEM