Fortinet Multiple Products Format String Vulnerability

Added Oct. 9, 2024 • Due Oct. 30, 2024 • CVE-2024-23113

Overdue Fortinet / Multiple Products CWE-134

Description

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

https://www.fortiguard.com/psirt/FG-IR-24-029
https://nvd.nist.gov/vuln/detail/CVE-2024-23113

Additional Information

Catalog Version: 2025.01.24
Catalog Released: Jan. 24, 2025
Days Until Due: 0 days
Last Updated: 4 months, 3 weeks ago