{"id":"CVE-2024-23109","published":"2024-02-05T13:26:02Z","modified":"2026-01-14T13:47:28Z","title":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in…","vendor":"Fortinet","product":"FortiSIEM","tier":"core","eol":null,"affectedVersions":[{"vendor":"Fortinet","product":"FortiSIEM","versions":["7.1.1",">= 7.0.0, <= 7.0.2",">= 6.7.0, <= 6.7.8",">= 6.6.0, <= 6.6.3",">= 6.5.0, <= 6.5.2",">= 6.4.0, <= 6.4.3"]}],"description":{"text":"An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet  allows attacker to execute unauthorized code or commands via via crafted API requests.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is an OS command injection vulnerability (improper neutralization of special elements used in an OS command) in Fortinet's FortiSIEM product. An attacker can execute unauthorized code or commands by sending crafted API requests, and the attack vector indicates this is reachable over the network with low complexity, requiring no privileges and no user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:46Z"},"cvss":{"score":9.7,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03293,"percentile":0.88466,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-02-25","exploitedFirstSeen":"2025-02-25","ransomware":true,"evidence":[{"url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","date":"2025-02-25"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/A_Deep_Dive_into_the_Leaked_Black_Basta_Chat_Logs.pdf","date":"2025-04-08"},{"url":"https://hunt.io/blog/keyplug-server-exposes-fortinet-exploits-webshells","date":"2025-04-17"},{"url":"https://asec.ahnlab.com/en/88063/","date":"2025-05-16"},{"url":"https://asec.ahnlab.com/ko/87992/","date":"2025-05-16"},{"url":"https://falconfeeds.io/blogs/china-cyber-campaign-critical-infrastructure-2024-2025","date":"2025-08-21"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":6,"pulses":[{"name":"ConnectWise breached in cyberattack linked to nation-state hackers","url":"https://otx.alienvault.com/pulse/684ba5053c71219d64210854","created":"2025-06-13"},{"name":"ConnectWise breached in cyberattack linked to nation-state hackers","url":"https://otx.alienvault.com/pulse/683d43391353f092be27ca11","created":"2025-06-02"},{"name":"KeyPlug Server Exposes Fortinet Exploits -  Webshell Activity Targeting a Major Japanese Company","url":"https://otx.alienvault.com/pulse/6807a13a2a7c67d990b69f34","created":"2025-04-22"},{"name":"RedGolf Hackers Exposes Fortinet Zero-Day Attack Tools","url":"https://otx.alienvault.com/pulse/6807102f931c2b2e7139ade9","created":"2025-04-22"},{"name":"KeyPlug-Linked Server Exposes Fortinet Exploits & Webshell Activity Targeting a Major Japanese Company","url":"https://otx.alienvault.com/pulse/6801707ed48a87a19adaf031","created":"2025-04-17"},{"name":"ACTUALIZACIÓN | FortiSIEM: inyección remota de múltiples comandos del sistema operativo no autenticado","url":"https://otx.alienvault.com/pulse/65c545d02f056b58a958c869","created":"2024-02-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-23-130","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-20634","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-20634","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-02-05","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-23109","provenance":"source"},{"date":"2025-02-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.qualys.com/vulnerabilities-threat-research/2025/02/25/defense-lessons-from-the-black-basta-ransomware-playbook","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":71.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 612 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":17.69,"detail":"percentile 0.8847"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.92,"detail":"6 pulses"},{"name":"CVSS severity","points":6.79,"detail":"base score 9.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}