CVE-2024-23108

—

CVSS 3.1

9.8 critical

EPSS

78%p100

Published

Feb 5, 2024 (Feb 5, 2024)

Modified

Jun 17, 2026

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Vendors: fortinet
Products: fortisiem
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (78.2%)

In the news7 stories

Fortinet warns about FortiSIEM vulnerability with in-the-wild exploit code (CVE-2025-25256)

Help Net SecurityAug 18, 10:08 UTC · Aug 18, 2025Vulnerability in the wildCVE-2025-25256 CVE-2023-34992 CVE-2024-23108

Week in review: Attackers trying to access Check Point VPNs, NIST CSF 2.0 security metrics evolution

Help Net SecurityJun 2, 00:00 UTC · Jun 2, 2024Ransomware CVE-2024-24919 CVE-2024-23108 CVE-2023-34992

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

The Hacker NewsMay 29, 12:58 UTC · May 29, 2024Vulnerability CVE-2024-20252 CVE-2024-20254 CVE-2024-20255+9 CVEs

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

Help Net SecurityMay 29, 00:00 UTC · May 29, 2024Exploit / PoC CVE-2024-23108 CVE-2023-34992 CVE-2024-23109

Experts released PoC exploit code for RCE in Fortinet SIEM

Security AffairsMay 28, 19:11 UTC · May 28, 2024Exploit / PoC in the wildCVE-2024-23108 CVE-2024-231091

Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

The Hacker NewsFeb 10, 06:49 UTC · Feb 10, 2024Exploit / PoC in the wildCVE-2024-21762 CVE-2024-23108 CVE-2024-23109+2 CVEs

Fortinet addressed two critical FortiSIEM vulnerabilities

Security AffairsFeb 7, 18:50 UTC · Feb 7, 2024Vulnerability CVE-2024-23108 CVE-2024-23109 CVE-2023-34992