CVE-2024-23108
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute...
- Published
- Feb 5, 2024
- Updated
- May 19, 2026
- Assigning CNA
- fortinet
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.6%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
Sources
network/cves/2024/CVE-2024-23108.yaml
Nuclei TemplatesDeclared conditions
- network: tcp($.protocol_keys)
- verification: word($.matchers[*].type)
POC iteration for CVE-2024-23108 which can use -l for list input
CVE-2024-23108: Fortinet FortiSIEM Unauthenticated 2nd Order Command Injection
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.