CVE-2024-23113

What it actually does

CVE-2024-23113 is a pre-authentication remote code execution vulnerability caused by externally controlled format string handling in affected Fortinet FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager versions. A network-reachable attacker can send specially crafted packets to vulnerable services and cause memory disclosure, memory corruption, or arbitrary code/command execution in the context of the affected process. Because the CVSS vector is network-accessible, low-complexity, requires no privileges, and requires no user interaction, exposed management or Fortinet control-plane services should be treated as high-risk.

Why it matters to the business

Successful exploitation can give an attacker control of security infrastructure that commonly sits at the network perimeter or manages privileged access. This can lead to firewall or proxy bypass, VPN and credential theft, traffic interception, configuration tampering, deployment of persistence, lateral movement, and service disruption. The vulnerability is in CISA KEV with a remediation due date of 2024-10-30, has known active exploitation, and has a high EPSS score, so unpatched internet-exposed systems represent an urgent operational risk even where ransomware use has not been specifically confirmed.

How an attack unfolds

An attacker first identifies Fortinet appliances or management products running affected FortiOS, FortiProxy, FortiPAM, or FortiSwitchManager versions, especially systems with management or Fortinet control-plane interfaces reachable from the internet or untrusted networks. The attacker then sends specially crafted packets containing malicious format string content to the vulnerable service. If exploitation succeeds, the service processes attacker-controlled format specifiers and corrupts or manipulates memory, allowing unauthorized command or code execution. From there, the attacker may enumerate configuration, dump credentials or session material, create or modify administrator accounts, change firewall/VPN/proxy policy, install persistence, stage tools, and use the compromised appliance as a trusted foothold for internal reconnaissance and lateral movement. Because exploitation has been observed in the wild and the issue is listed in KEV, defenders should assume opportunistic scanning and targeted exploitation are both plausible.

How to fix it

Upgrade affected products to fixed Fortinet releases or later. Based on the affected ranges, upgrade FortiOS 7.4.0-7.4.2 to 7.4.3 or later, FortiOS 7.2.0-7.2.6 to 7.2.7 or later, and FortiOS 7.0.0-7.0.13 to 7.0.14 or later. Upgrade FortiProxy 7.4.0-7.4.2 to 7.4.3 or later, FortiProxy 7.2.0-7.2.8 to 7.2.9 or later, and FortiProxy 7.0.0-7.0.14 to 7.0.15 or later. Upgrade FortiPAM 1.2.0 to 1.2.1 or later, 1.1.0-1.1.2 to 1.1.3 or later, and 1.0.0-1.0.3 to 1.0.4 or later. Upgrade FortiSwitchManager 7.2.0-7.2.3 to 7.2.4 or later and 7.0.0-7.0.3 to 7.0.4 or later. If immediate upgrade is not possible, restrict administrative and Fortinet management/control-plane access to trusted management networks only, disable unnecessary externally reachable services, enforce VPN or bastion access for administration, block untrusted access to Fortinet management ports, and monitor closely for crashes, unexpected configuration changes, and suspicious administrative activity. Mitigation should be considered temporary; patching is required.

How to confirm the fix worked

Confirm the installed firmware/software version is outside the affected ranges using the product CLI, GUI, FortiManager/FortiAnalyzer inventory, or authenticated vulnerability scanning. Verify that management and Fortinet control-plane services are not reachable from the internet or untrusted networks unless explicitly required and protected. Run external exposure checks for HTTPS/SSH administrative interfaces and Fortinet management/control-plane ports such as TCP/541 where applicable. After upgrade, confirm the device reports the expected fixed version, review vendor release notes, and validate that no vulnerable FortiOS, FortiProxy, FortiPAM, or FortiSwitchManager assets remain in asset inventory. Also compare configuration backups before and after remediation to identify unauthorized changes that may have occurred before patching.

Typical attack path

1. Scan for exposed Fortinet FortiOS, FortiProxy, FortiPAM, or FortiSwitchManager services and fingerprint vulnerable version ranges.
2. Confirm reachability of management or Fortinet control-plane services from an untrusted network.
3. Send crafted packets that trigger the externally controlled format string condition.
4. Achieve unauthorized code or command execution in the vulnerable service context.
5. Run discovery commands, read device configuration, and collect credentials, VPN material, certificates, or tokens where accessible.
6. Establish persistence by changing configuration, adding users or API keys, modifying policies, or staging files.
7. Use the compromised appliance to proxy traffic, intercept communications, pivot into internal networks, or disrupt security controls.

How to detect it

To determine whether exploitation already occurred, review Fortinet system, event, crash, administrative, VPN, and configuration logs from the exposure window, including logs forwarded to FortiAnalyzer or a SIEM because local appliance logs may be limited or overwritten. Look for crashes or restarts of Fortinet management/control-plane daemons, especially fgfmd, immediately followed by new administrator logins, configuration changes, policy changes, VPN changes, or outbound connections to unusual destinations. Examine network telemetry for unsolicited inbound traffic to Fortinet management or control-plane services, including TCP/541 where applicable, and for spikes in malformed sessions or repeated connection attempts from internet scanners. Compare configuration revisions for unexpected administrator accounts, trusted-host changes, API tokens, automation stitches, scripts, firewall/proxy/VPN policy modifications, new static routes, altered logging destinations, or disabled security controls. Check for suspicious files, modified startup/configuration artifacts, unexplained processes, and abnormal outbound traffic from the appliance. If compromise is suspected, preserve logs, configuration backups, crash dumps, and memory where possible before rebooting or factory resetting.

• fgfmd
• tcp/541
• TCP/541
• port 541
• signal 11
• segmentation fault
• Segmentation fault
• daemon fgfmd
• fgfmd crashed
• fgfmd crash
• crashlog
• wad crash
• new admin
• Administrator login successful
• Configuration changed
• cfg-change
• config system admin
• set accprofile super_admin
• set trusthost
• set remote-auth enable
• execute backup config
• diagnose debug crashlog read
• /data/crashlog
• /var/log
• /bin/fgfmd

What your security team should do

• Immediately inventory all FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager deployments and identify versions in the affected ranges.
• Prioritize patching internet-facing or untrusted-network-reachable systems first because exploitation is unauthenticated, low-complexity, and listed in CISA KEV.
• Restrict management-plane and Fortinet control-plane access to dedicated trusted networks; remove direct internet exposure wherever possible.
• Review system, event, crash, administrative, VPN, and configuration-change logs for evidence of exploitation before and after patching.
• Rotate local administrator passwords, API keys, VPN secrets, certificates, and integration credentials if exploitation is suspected or logs show unexplained administrative activity.
• Audit administrator accounts, trusted hosts, firewall/proxy/VPN policies, automation scripts, scheduled tasks, and configuration revisions for unauthorized changes.
• Capture forensic artifacts before rebooting or reimaging suspected compromised appliances when feasible, because volatile evidence may be lost.
• Add SIEM detections for unexpected access to Fortinet management services, fgfmd crashes, abnormal outbound connections from appliances, and unauthorized configuration changes.
• Treat appliances that show signs of compromise as potentially untrusted network infrastructure; rebuild from known-good firmware and restore only reviewed configuration.