CVE-2024-23113
Fortinet Multiple Products Format String Vulnerability
Description
CVE-2024-23113 is a critical format string vulnerability affecting multiple Fortinet products, including FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager, that allows a remote unauthenticated attacker to execute unauthorized code or commands. The flaw exploits externally-controlled format string input in the FGFM (FortiGate to FortiManager) protocol daemon. With a CVSS v3.1 base score of 9.8 (CRITICAL) and no authentication or user interaction required, this vulnerability is trivially exploitable by any attacker with network access to the affected service. CISA added CVE-2024-23113 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024, and its EPSS score of 51.81% at the 97.8th percentile confirms active exploitation across the Fortinet product ecosystem.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiproxy | >= 7.0.0, <= 7.0.14; >= 7.2.0, <= 7.2.8; >= 7.4.0, <= 7.4.2 |
| fortinet | fortiswitchmanager | >= 7.0.0, <= 7.0.3; >= 7.2.0, <= 7.2.3 |
| fortinet | fortios | >= 7.0.0, <= 7.0.13; >= 7.2.0, <= 7.2.6; >= 7.4.0, <= 7.4.2 |
| fortinet | fortipam | >= 1.0.0, <= 1.0.3; >= 1.1.0, <= 1.1.2; 1.2.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.com/psirt/FG-IR-24-029(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113(US Government Resource)
Weakness Type
CWE-134: Use of Externally-Controlled Format String
CVE-2024-23113 exploits an externally-controlled format string weakness in Fortinet's FGFM protocol implementation. Format string vulnerabilities occur when user-supplied input is used directly as a format string argument in functions like printf(), sprintf(), or similar formatting functions. An attacker can inject format specifiers (such as %s, %x, %n) to read from or write to arbitrary memory locations, enabling information disclosure, denial of service, or arbitrary code execution. This class of vulnerability is particularly dangerous because it can achieve the same impact as buffer overflows with relatively straightforward exploitation.
Learn more: CWE-134 — Use of Externally-Controlled Format String
Impact Analysis
The impact of CVE-2024-23113 is devastating, with Confidentiality (High), Integrity (High), and Availability (High) fully compromised. The attack is network-accessible (AV:N) with low complexity (AC:L), requires no privileges (PR:N) and no user interaction (UI:N), making it trivially exploitable against any exposed Fortinet device running the FGFM daemon. The breadth of affected products is exceptional, spanning FortiOS (the operating system powering FortiGate firewalls), FortiProxy (web proxy), FortiPAM (privileged access management), and FortiSwitchManager (switch management). FortiGate firewalls are among the most widely deployed network security appliances globally, and compromising the firewall gives attackers complete control over the network perimeter, including the ability to intercept and modify all network traffic, disable security policies, create VPN backdoors, and pivot into internal networks. The EPSS score of 51.81% at the 97.8th percentile indicates substantial exploitation activity. While the ransomware nexus is listed as Unknown, Fortinet device compromises have historically been leveraged by both APT groups and ransomware operators as initial access vectors for enterprise network intrusions.
Exploit Maturity
CVE-2024-23113 has reached high exploit maturity with confirmed active exploitation. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 30, 2024. The EPSS score of 51.81% at the 97.8th percentile indicates active exploitation campaigns. Fortinet published a detailed advisory at FG-IR-24-029 documenting the vulnerability and affected versions. The format string vulnerability is in the FGFM protocol daemon, which listens on TCP port 541 and is used for FortiGate-to-FortiManager communication. Exploitation requires only network access to this port and knowledge of the FGFM protocol format. Format string vulnerabilities have well-established exploitation techniques, and the availability of Fortinet device firmware for reverse engineering allows attackers to develop reliable exploits. The vulnerability was disclosed in February 2024, providing a significant window for exploitation before many organizations applied patches, particularly given the operational sensitivity of patching production firewall infrastructure.
Remediation
-
Upgrade affected Fortinet products immediately to patched versions as documented in FortiGuard advisory FG-IR-24-029: FortiOS to 7.4.3+, 7.2.7+, or 7.0.14+; FortiProxy to 7.4.3+, 7.2.9+, or 7.0.15+; FortiPAM to 1.2.1+ or 1.1.3+; FortiSwitchManager to 7.2.4+ or 7.0.4+.
-
Disable the FGFM service on devices that do not require FortiManager management. If FortiManager connectivity is not used, disabling the FGFM listener on TCP port 541 eliminates the attack surface entirely. For devices that require FortiManager, restrict FGFM access to specific FortiManager IP addresses using local-in policies.
-
Restrict network access to the FGFM port (TCP 541) using external firewall rules or access control lists. The FGFM protocol should never be accessible from the internet, and access should be limited exclusively to authorized FortiManager instances on trusted management networks.
-
Audit Fortinet device configurations and logs for indicators of compromise including unauthorized admin accounts, modified security policies, new VPN configurations, unusual FGFM connections, and unexpected firmware changes. Check for evidence of configuration exports or credential harvesting.
-
Implement network segmentation for management traffic by placing Fortinet management interfaces on a dedicated out-of-band management network that is isolated from production traffic. Use jump servers with multi-factor authentication for management access, and monitor management network traffic for anomalous activity.
Technical Details
CVE-2024-23113 is an externally-controlled format string vulnerability in multiple Fortinet products. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) and no user interaction (UI:N), with Unchanged scope (S:U) and maximum impact across confidentiality, integrity, and availability. The vulnerability resides in the FGFM (FortiGate to FortiManager) protocol daemon, which handles management communication between FortiGate appliances and FortiManager instances. The FGFM daemon listens on TCP port 541 and processes protocol messages that include string fields. The format string vulnerability occurs when attacker-controlled data from FGFM protocol messages is passed directly as a format string argument to a C formatting function. An attacker can craft FGFM protocol messages containing format specifiers that read stack memory (%x, %s), write to arbitrary memory locations (%n), or cause crashes. The %n format specifier is particularly dangerous as it writes the number of bytes output so far to a memory address specified on the stack, enabling arbitrary memory writes that can redirect execution flow to attacker-controlled shellcode. The affected products span FortiOS 7.0.0-7.4.2, FortiProxy 7.0.0-7.4.2, FortiPAM 1.0.0-1.2.0, and FortiSwitchManager 7.0.0-7.2.3, representing years of Fortinet deployments across the product portfolio.
Frequently Asked Questions
Is CVE-2024-23113 being actively exploited?
Yes, CISA confirmed active exploitation and added CVE-2024-23113 to the Known Exploited Vulnerabilities catalog. The EPSS score of 51.81% at the 97.8th percentile indicates substantial ongoing exploitation targeting exposed Fortinet devices.
What products are affected by CVE-2024-23113?
FortiOS versions 7.0.0-7.4.2, FortiProxy 7.0.0-7.4.2, FortiPAM 1.0.0-1.2.0, and FortiSwitchManager 7.0.0-7.2.3 are affected. This covers FortiGate firewalls, web proxies, privileged access management, and switch management appliances across the Fortinet ecosystem.
How do I fix CVE-2024-23113?
Upgrade to patched Fortinet firmware versions: FortiOS 7.4.3+, FortiProxy 7.4.3+, FortiPAM 1.2.1+, or FortiSwitchManager 7.2.4+. As a workaround, disable the FGFM service if FortiManager connectivity is not required, or restrict FGFM access to specific FortiManager IP addresses.
What is a format string vulnerability?
A format string vulnerability occurs when attacker-controlled input is used directly as a format string in functions like printf(). Format specifiers like %x read memory contents and %n writes to memory, allowing attackers to read sensitive data, crash the application, or execute arbitrary code. Unlike buffer overflows, format string attacks exploit the formatting function's built-in capabilities rather than overwriting adjacent memory.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.