CVE-2024-23109

—

CVSS 3.1

9.8 critical

EPSS

3%p87

Published

Feb 5, 2024 (Feb 5, 2024)

Modified

Jun 17, 2026

Description

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Vendors: fortinet
Products: fortisiem
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news5 stories

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

The Hacker NewsMay 29, 12:58 UTC · May 29, 2024Vulnerability CVE-2024-20252 CVE-2024-20254 CVE-2024-20255+9 CVEs

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

Help Net SecurityMay 29, 00:00 UTC · May 29, 2024Exploit / PoC CVE-2024-23108 CVE-2023-34992 CVE-2024-23109

Experts released PoC exploit code for RCE in Fortinet SIEM

Security AffairsMay 28, 19:11 UTC · May 28, 2024Exploit / PoC in the wildCVE-2024-23108 CVE-2024-231091

Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

The Hacker NewsFeb 10, 06:49 UTC · Feb 10, 2024Exploit / PoC in the wildCVE-2024-21762 CVE-2024-23108 CVE-2024-23109+2 CVEs

Fortinet addressed two critical FortiSIEM vulnerabilities

Security AffairsFeb 7, 18:50 UTC · Feb 7, 2024Vulnerability CVE-2024-23108 CVE-2024-23109 CVE-2023-34992