9.8 Critical Exploited

CVE-2024-23113 Fortinet Multiple Products Format String Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-134

Description

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Affected products and versions

Product	Affected versions	Fixed in
FortiSwitchManager 7.2	7.2.0 → 7.2.3	No fix stated
FortiSwitchManager 7.0	7.0.0 → 7.0.3	No fix stated
FortiOS 7.4	7.4.0 → 7.4.2	No fix stated
FortiOS 7.2	7.2.0 → 7.2.6	No fix stated
FortiOS 7.0	7.0.0 → 7.0.13	No fix stated
FortiPAM	1.2.0	No fix stated
FortiPAM 1.1	1.1.0 → 1.1.2	No fix stated
FortiPAM 1.0	1.0.0 → 1.0.3	No fix stated
FortiProxy 7.4	7.4.0 → 7.4.2	No fix stated

Show the 2 other branches

Product	Affected versions	Fixed in
FortiProxy 7.2	7.2.0 → 7.2.8	No fix stated
FortiProxy 7.0	7.0.0 → 7.0.15	No fix stated

References

fortiguard.com fortiguard.com

Timeline

Published February 15, 2024
Added to the KEV catalogue October 9, 2024
Last modified October 21, 2025

The 20 CVEs of FortiSwitchManager →

CVE-2026-59840 A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all… 4.1 Medium CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability 5.4 Medium CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability 7.4 High CVE-2025-59718 Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability 9.1 Critical

Track this CVE