Actively exploited in the wild
Fortinet Multiple Products Format String Vulnerability
Fortinet - Multiple Products · Listed in the CISA KEV since 2024-10-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-23113
CriticalCVSS 9.8KEVSummary
A use of externally-controlled format string in Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager allows an attacker to execute unauthorized code or commands via specially crafted packets.
Risk Assessment
This vulnerability allows remote code execution without authentication, potentially leading to full compromise of the Fortinet device.
Recommendation
Immediately update Fortinet software to the latest version that fixes this vulnerability.
Other vulnerabilities in Fortinet FortiOS
See all- CVE-2017-7738High
CVE-2017-7738 is an Information Disclosure vulnerability in Fortinet FortiOS versions 5.6.0 to 5.6.2, 5.4.0 to 5.4.5, and 5.2 and below, allowing an admin user with super_admin privileges to view current SSL VPN web portal session info, which may contain user credentials.
- CVE-2024-21762CriticalActively exploited
An out-of-bounds write in Fortinet FortiOS and FortiProxy allows an attacker to execute unauthorized code or commands via specifically crafted requests. Affects multiple versions of FortiOS and FortiProxy.
- CVE-2018-13374MediumActively exploited
An improper access control vulnerability in Fortinet FortiOS and FortiADC allows an attacker to obtain LDAP server login credentials configured in FortiGate by pointing a connectivity test to a rogue LDAP server.
- CVE-2026-84392Low
A NULL Pointer Dereference vulnerability (CWE-476) in Fortinet FortiOS 7.4 and 7.2 (all versions), FortiPAM (multiple versions), and FortiProxy 7.6.0-7.6.6, 7.4, and 7.2 (all versions) may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests.
- CVE-2025-67862Medium
Fortinet FortiOS and FortiProxy in multiple versions contain a vulnerability exposing an internal asset to an unsafe debug access level. This allows an authenticated admin to execute Lua scripts via crafted CLI commands.
- CVE-2025-53844High
An out-of-bounds write vulnerability in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and 7.2.0 through 7.2.11 allows an attacker to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58413High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, 6.4, 6.2, and 6.0. An attacker can execute unauthorized code or commands via specially crafted packets.
- CVE-2025-53843High
A stack-based buffer overflow vulnerability exists in Fortinet FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, and all versions of 7.2, 7.0, and 6.4. An attacker can exploit this vulnerability to execute unauthorized code or commands via specially crafted packets.
- CVE-2025-58903Low
CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.
- CVE-2024-52963Low
An out-of-bounds write in Fortinet FortiOS versions 7.6.0, 7.4.0 through 7.4.6, 7.2.0 through 7.2.10, 7.0.0 through 7.0.16, and 6.4.0 through 6.4.15 allows an attacker to trigger a denial of service via specially crafted packets.
Original NVD description (English source)
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.