CVE-2024-23109
Published: 05 February 2024
Summary
CVE-2024-23109 is a critical-severity OS Command Injection (CWE-78) vulnerability in Fortinet Fortisiem. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 8.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-23109 is an OS command injection vulnerability, tracked as CWE-78, that affects Fortinet products. The flaw stems from improper neutralization of special elements in OS commands and can be triggered through crafted API requests, resulting in a CVSS 3.1 score of 10.0 with full impact on confidentiality, integrity, and availability plus a changed scope.
Unauthenticated attackers with network access can send malicious API requests to execute arbitrary code or commands on affected systems, enabling complete compromise of the target without any user interaction or credentials.
Fortinet has published advisory FG-IR-23-130 at fortiguard.com/psirt/FG-IR-23-130 detailing the issue and associated mitigations.
The EPSS score remains flat at 0.0703 with no reported real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-20634
Vulnerability details
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.