Critical severity · published Feb 5, 2024
CVE-2024-23108
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands…
9.8
CVSS
80.3%
EPSS
No
On KEV
Description
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)80.3% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Fortisiem · Fortinet
6.4.0 through 6.4.2; 6.5.0 through 6.5.2; 6.6.0 through 6.6.3; 6.7.0 through 6.7.8; 7.0.0 through 7.0.2; 7.1.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23108
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23108
Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-130
github.com
https://github.com/horizon3ai/CVE-2024-23108
More from Fortisiem
9.8
CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or…
9.8
CVE-2025-64155
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM…
9.8
CVE-2025-25256
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1,…
9.8
CVE-2024-23109
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands…
9.8
CVE-2023-36553
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8…