CVE-2023-34992
published 2023-10-10CVE-2023-34992: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized…
PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
65.51%
99.2th percentile
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fortinet | fortinet | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | — | — |
| fortinet | fortisiem | 6.4.0 – 6.4.2 | — |
| fortinet | fortisiem | 6.5.0 – 6.5.1 | — |
| fortinet | fortisiem | 6.6.0 – 6.6.3 | — |
| fortinet | fortisiem | 6.7.0 – 6.7.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
port7900
snort
alert tcp any any -> $HOME_NET 7900 (msg:"ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992"; flow:established,to_server; content:"|51 00 00 00|"; startswith; content:"]*>[^\x3b/Rsi"; reference:url,horizon3.ai/attack-research/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive/; reference:cve,2023-34992; classtype:misc-attack; sid:2052888; rev:2; metadata:attack_target Server, created_at 2024_05_28, cve CVE_2023_34992, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_05_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
bytes
|51 00 00 00|
- →Exploit traffic targets TCP port 7900 (phMonitor service) with a specific 4-byte little-endian length prefix |51 00 00 00| at the start of the TCP payload, followed by content matching the pattern ]*>[^\x3b/Rsi
- →Exploitation attempts against the patch bypass variant (CVE-2024-23108) leave a log message containing a failed command referencing 'datastore.py nfs test' — hunt for this string in FortiSIEM logs ↗
- →For the related CVE-2025-64155 variant, check /opt/phoenix/log/phoenix.logs for 'PHL_ERROR' lines that include a payload URL and destination file path, indicating active exploitation of the phMonitor service ↗
- →The vulnerability is exploited via crafted API requests to the FortiSIEM supervisor/report server; monitor for anomalous unauthenticated API calls to FortiSIEM endpoints ↗
- ·The phMonitor service (port 7900) exposes dozens of command handlers remotely without authentication and has been the entry point for multiple FortiSIEM CVEs; blocking or restricting access to this port is the vendor-recommended workaround when patching is not immediately possible ↗
- ·The patch for CVE-2023-34992 added wrapShellToken() to escape user-controlled inputs, but this was insufficient — a second-order command injection remained exploitable when certain parameters to datastore.py are sent ↗
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Fortinet
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet...
vendor_fortinet·2023-10-10·CVSS 10.0
CVE-2023-34992 [CRITICAL] CWE-78 A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet...
FG-IR-23-130: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet...
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.
CVEs: CVE-2023-34992, CVE-2024-23108, CVE-2024-23109
CWEs: CWE-78
CVSS: 10.0 (critical)
Affected products: FortiSIEM, Fortinet
GHSA
GHSA-22fj-hq2r-qcpq: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7
ghsa_unreviewed·2023-10-10
CVE-2023-34992 [CRITICAL] CWE-78 GHSA-22fj-hq2r-qcpq: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.0.0 and 6.7.0 through 6.7.5 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via crafted API requests.
Suricata
ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992
suricata·2024-05-28·CVSS 10.0
CVE-2023-34992 [CRITICAL] ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992
ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992
Rule: alert tcp any any -> $HOME_NET 7900 (msg:"ET EXPLOIT Fortinet FortiSIEM Unauthenticated Command Injection CVE-2023-34992"; flow:established,to_server; content:"|51 00 00 00|"; startswith; content:"]*>[^\x3b/Rsi"; reference:url,horizon3.ai/attack-research/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive/; reference:cve,2023-34992; classtype:misc-attack; sid:2052888; rev:2; metadata:attack_target Server, created_at 2024_05_28, cve CVE_2023_34992, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag Exploit, updated_at 2024_05_31, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_App
No public exploits indexed.
Bleepingcomputer
Exploit code public for critical FortiSIEM command injection flaw
blogs_bleepingcomputer·2026-01-14·CVSS 10.0
CVE-2025-64155 [CRITICAL] Exploit code public for critical FortiSIEM command injection flaw
## Exploit code public for critical FortiSIEM command injection flaw
## Bill Toulas
Technical details and a public exploit have been published for a critical vulnerability affecting Fortinet's Security Information and Event Management (SIEM) solution that could be leveraged by a remote, unauthenticated attacker to execute commands or code.
The vulnerability is tracked as CVE-2025-64155, and is a combination of two issues that permit arbitrary write with admin permissions and privilege escalation to root access.
Researchers at penetration testing company Horizon3.ai reported the security issue in mid-August 2025, but it was only fixed on January 13, 2026.
Fortinet describes the CVE-2025-64155 vulnerability as "an improper neutralization of special elements used in an OS command vulnera
Bleepingcomputer
Exploit released for maximum severity Fortinet RCE bug, patch now
blogs_bleepingcomputer·2024-05-28·CVSS 10.0
CVE-2024-23108 [CRITICAL] Exploit released for maximum severity Fortinet RCE bug, patch now
## Exploit released for maximum severity Fortinet RCE bug, patch now
## Sergiu Gatlan
Security researchers have released a proof-of-concept (PoC) exploit for a maximum-severity vulnerability in Fortinet's security information and event management (SIEM) solution, which was patched in February.
Tracked as CVE-2024-23108 , this security flaw is a command injection vulnerability discovered and reported by Horizon3 vulnerability expert Zach Hanley that enables remote command execution as root without requiring authentication.
"Multiple improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiSIEM supervisor may allow a remote unauthenticated attacker to execute unauthorized commands via crafted API requests," Fortinet says .
CVE-2024-23108 impacts
Wiz
Crying Out Cloud - March 2024 Newsletter | Wiz
blogs_wiz·2024-03-01·CVSS 8.6
CVE-2024-21626 [HIGH] Crying Out Cloud - March 2024 Newsletter | Wiz
Welcome back! In this edition, we bring you the latest in cloud security – crucial vulnerabilities, exclusive data, and noteworthy incidents. Stay informed and stay secure. Let's delve in.
Here are our cloud security highlights!
## 🐞 High Profile Vulnerabilities
Leaky Vessels: Docker and runc Container Escape Vulnerabilities
Several vulnerabilities have been revealed in the runC command line tool (CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653). These flaws pose a risk of container escape, exploiting these vulnerabilities could grant unauthorized access to the host operating system, potentially compromising sensitive data and facilitating further attacks, particularly with superuser privileges.
According to Wiz data, 18% percent of cloud environments have resources
Bleepingcomputer
New Fortinet RCE bug is actively exploited, CISA confirms
blogs_bleepingcomputer·2024-02-09·CVSS 10.0
CVE-2024-21762 [CRITICAL] New Fortinet RCE bug is actively exploited, CISA confirms
## New Fortinet RCE bug is actively exploited, CISA confirms
## Sergiu Gatlan
CISA confirmed today that attackers are actively exploiting a critical remote code execution (RCE) bug patched by Fortinet on Thursday.
The flaw (CVE-2024-21762) is due to an out-of-bounds write weakness in the FortiOS operating system and the FortiProxy secure web proxy that can let unauthenticated attackers execute arbitrary code remotely using maliciously crafted HTTP requests.
Admins who can't immediately deploy security updates to patch vulnerable appliances can remove the attack vector by disabling SSL VPN on the device.
CISA's announcement comes one day after Fortinet published a security advisory saying the flaw was "potentially being exploited in the wild."
While the company has yet to share more d
Bleepingcomputer
Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure
blogs_bleepingcomputer·2024-02-07·CVSS 10.0
CVE-2024-23108 [CRITICAL] Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure
## Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure
## Lawrence Abrams
Fortinet is warning of two new unpatched patch bypasses for a critical remote code execution vulnerability in FortiSIEM, Fortinet's SIEM solution.
Fortinet added the two new vulnerabilities tracked as CVE-2024-23108 and CVE-2024-23109 to the original advisory for the CVE-2023-34992 flaw in a very confusing update.
Earlier today, BleepingComputer published an article that the CVEs were released by mistake after being told by Fortinet that they were duplicates of the original CVE-2023-34992.
"In this instance, due to an issue with the API which we are currently investigating, rather than an edit, this resulted in two new CVEs being created, duplicates of the original CVE-2023-34992," Fortinet told Ble
Bleepingcomputer
Fortinet warns of critical command injection bug in FortiSIEM
blogs_bleepingcomputer·2023-11-16·CVSS 10.0
[CRITICAL] Fortinet warns of critical command injection bug in FortiSIEM
## Fortinet warns of critical command injection bug in FortiSIEM
## Bill Toulas
Fortinet is alerting customers of a critical OS command injection vulnerability in FortiSIEM report server that could be exploited by remote, unauthenticated attackers to execute commands through specially crafted API requests.
FortiSIEM (Security Information and Event Management) is a comprehensive cybersecurity solution that provides organizations with enhanced visibility and granular control over their security posture.
It is used in businesses of all sizes in the healthcare, financial, retail, e-commerce, government, and public sectors.
## Variant of another OS command injection
Now tracked as CVE-2023-36553, Fortinet's product security team earlier this week discovered the flaw and assigned it a crit
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
2023-10-10
Published