CVE-2024-23108
Published: 05 February 2024
Summary
CVE-2024-23108 is a critical-severity OS Command Injection (CWE-78) vulnerability in Fortinet Fortisiem. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-23108 is an OS command injection vulnerability, tracked as CWE-78, that affects Fortinet products. The flaw stems from improper neutralization of special elements in OS commands and permits unauthenticated attackers to execute arbitrary code or commands by sending crafted API requests. It carries a maximum CVSS 3.1 score of 10.0 with a network attack vector, low complexity, no required privileges or user interaction, and changed scope that yields full impacts on confidentiality, integrity, and availability.
Remote attackers can exploit the issue over the network to run unauthorized commands on affected Fortinet systems, potentially leading to complete compromise of the targeted component or connected infrastructure.
Fortinet's advisory FG-IR-23-130, referenced at fortiguard.com/psirt/FG-IR-23-130, supplies official mitigation guidance and patch information for the vulnerability. A public proof-of-concept is also available in the horizon3ai GitHub repository.
The CVE maintains a high EPSS score, recorded at a current value of 0.9039 with a peak of 0.9183.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20633
Vulnerability details
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.