NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

Vulnerability7 · 1 read

CVE-2024-23109

CVSS 3.1: 9.8 critical
EPSS: 3%p87
Published: Feb 5, 2024 · Feb 5, 2024
Modified: Jun 17, 2026

Analyze CVE-2024-23109 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.

Vendors: fortinet

Products: fortisiem

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.2%)

In the news

5 stories

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

The Hacker NewsMay 29, 12:58 UTC · May 29, 2024VulnerabilityCVE-2024-20252 CVE-2024-20254 CVE-2024-20255+91

60

PoC exploits for critical FortiSIEM command execution flaws released (CVE-2024-23108, CVE-2023-34992)

Help Net SecurityMay 29, 00:00 UTC · May 29, 2024Exploit / PoCCVE-2024-23108 CVE-2023-34992 CVE-2024-231094 · 2 reads

60

Experts released PoC exploit code for RCE in Fortinet SIEM

Security AffairsMay 28, 19:11 UTC · May 28, 2024Exploit / PoCExploitedCVE-2024-23108 CVE-2024-231091

60

Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

The Hacker NewsFeb 10, 06:49 UTC · Feb 10, 2024Exploit / PoCExploitedCVE-2024-21762 CVE-2024-23108 CVE-2024-23109+21

60

Fortinet addressed two critical FortiSIEM vulnerabilities

Security AffairsFeb 7, 18:50 UTC · Feb 7, 2024VulnerabilityCVE-2024-23108 CVE-2024-23109 CVE-2023-349923 · 2 reads

60