CVE-2023-34992 | FortiGate - API Operational Intel

Executive Risk Summary

"A vulnerability in Fortinet's API allows attackers to execute unauthorized code or commands via crafted API requests, potentially leading to system compromise. This vulnerability poses a significant risk to the security and integrity of affected systems, and immediate attention is recommended to mitigate potential attacks."

Operational Audit Arsenal

Target Type Firmware Image

Target Asset FortiGate Firmware

Standard Path Global Firmware

Manual Verification Required

This is a non-Windows asset (Fortinet). Use the target asset details above to verify your version against vendor advisories.

Patch Impact Forecast

Reboot Required Likely

Moderate

Internal Work Notes

CVE-2023-34992: FortiGate API vulnerability allowing os command injection, requiring immediate patching to prevent potential system compromise.

Technical Intelligence & Operational Utilities • Delivered Weekly

Intelligence Sources

Official Advisoryhttps://fortiguard.com/psirt/FG-IR-23-130

Scope of Impact

Fortinet Fortisiem (Version 6.4.2)Fortinet Fortisiem (Version 6.4.1)Fortinet Fortisiem (Version 6.5.0)Fortinet Fortisiem (Version 7.0.0)Fortinet FortisiemFortinet Fortisiem (Version 6.5.1)Fortinet Fortisiem (Version 6.4.0)

Original NVD Description

"A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests."

Related Fortinet Threats

CVE-2024-23108 CVSS 10

FortiGate - API

CVE-2024-23109 CVSS 10

FortiGate - API

CVE-2023-40714 CVSS 9.9

FortiSIEM - GUI

Data compiled from NVD, MSRC, and CISA KEV Catalog. Intelligence synthesized via AI. Scripts provided for diagnostic purposes under MIT License.