{"id":"CVE-2024-23108","published":"2024-02-05T13:26:15Z","modified":"2026-05-19T16:31:19Z","title":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSIEM","versions":[">= 7.1.0, <= 7.1.1",">= 7.0.0, <= 7.0.2",">= 6.7.0, <= 6.7.8",">= 6.6.0, <= 6.6.3",">= 6.5.0, <= 6.5.2",">= 6.4.0, <= 6.4.3"]}],"description":{"text":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet  allows attacker to execute unauthorized code or commands via via crafted API requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"An OS command injection flaw in Fortinet's FortiSIEM product allows an attacker to execute unauthorized code or commands. An attacker can exploit it remotely over the network via crafted API requests, without needing credentials or any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:46Z"},"cvss":{"score":9.7,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.80304,"percentile":0.9962,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-02-25","exploitedFirstSeen":"2025-02-25","ransomware":true,"evidence":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","date":"2025-02-25"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf","date":"2025-04-08"},{"url":"https://hunt.io/blog/keyplug-server-exposes-fortinet-exploits-webshells","date":"2025-04-17"},{"url":"https://asec.ahnlab.com/en/88063/","date":"2025-05-16"},{"url":"https://asec.ahnlab.com/ko/87992/","date":"2025-05-16"},{"url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025","date":"2025-08-21"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"ConnectWise breached in cyberattack linked to nation-state hackers","url":"https://otx.alienvault.com/pulse/684ba5053c71219d64210854","created":"2025-06-13"},{"name":"ConnectWise breached in cyberattack linked to nation-state hackers","url":"https://otx.alienvault.com/pulse/683d43391353f092be27ca11","created":"2025-06-02"},{"name":"KeyPlug Server Exposes Fortinet Exploits -  Webshell Activity Targeting a Major Japanese Company","url":"https://otx.alienvault.com/pulse/6807a13a2a7c67d990b69f34","created":"2025-04-22"},{"name":"RedGolf Hackers Exposes Fortinet Zero-Day Attack Tools","url":"https://otx.alienvault.com/pulse/6807102f931c2b2e7139ade9","created":"2025-04-22"},{"name":"KeyPlug-Linked Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company","url":"https://otx.alienvault.com/pulse/6801707ed48a87a19adaf031","created":"2025-04-17"},{"name":"ACTUALIZACIÓN | FortiSIEM: inyección remota de múltiples comandos del sistema operativo no autenticado","url":"https://otx.alienvault.com/pulse/65c545d02f056b58a958c869","created":"2024-02-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-130","tags":[]},{"url":"https://github.com/horizon3ai/CVE-2024-23108","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-20633","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20633","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2024-05-20","earliestUrl":"https://github.com/horizon3ai/CVE-2024-23108","repos":[{"name":"horizon3ai/CVE-2024-23108","url":"https://github.com/horizon3ai/CVE-2024-23108","stars":35,"created":"2024-05-20"},{"name":"hitem/CVE-2024-23108","url":"https://github.com/hitem/CVE-2024-23108","stars":6,"created":"2024-05-28"}]},"nuclei":[{"id":"CVE-2024-23108","name":"Fortinet FortiSIEM - OS Command Injection","severity":"critical","path":"network/cves/2024/CVE-2024-23108.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2024/CVE-2024-23108.yaml"}],"first":{"date":"2024-05-20","source":"PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-23108"},"provenance":"source"},"exploitRefs":["https://github.com/horizon3ai/CVE-2024-23108"],"flow":[],"timeline":[{"date":"2024-02-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-23108","provenance":"source"},{"date":"2024-05-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/horizon3ai/CVE-2024-23108","provenance":"source"},{"date":"2025-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","provenance":"source"}],"speed":{"daysToPublicExploit":105,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":78.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 612 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9962"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.79,"detail":"base score 9.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}