CVE-2024-23110

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A stack-based buffer overflow in Fortinet FortiOS version 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0 all versions allows attacker to execute unauthorized code or commands via specially crafted commands

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Fortinet	FortiOS	>= 7.4.0, <= 7.4.2; >= 7.2.0, <= 7.2.6; >= 7.0.0, <= 7.0.13; >= 6.4.0, <= 6.4.14; >= 6.2.0, <= 6.2.15; >= 6.0.0, <= 6.0.18
fortinet	fortios	>= 7.4.0, <= 7.4.2
fortinet	fortios	>= 7.2.0, <= 7.2.6
fortinet	fortios	>= 7.0.0, <= 7.0.13
fortinet	fortios	>= 6.4.0, <= 6.4.14
fortinet	fortios	>= 6.2.0, <= 6.2.15
fortinet	fortios	>= 6.0.0, <= 6.0.18

References

https://fortiguard.com/psirt/FG-IR-23-460Vendor Advisory
https://fortiguard.com/psirt/FG-IR-23-460Vendor Advisory

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-231114.8An improper neutralization of input during web page Generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiOS version 7.4.3 and CVE-2024-231124.3An authorization bypass through user-controlled key vulnerability [CWE-639] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 CVE-2024-231139.8A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo CVE-2024-231149.8Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe de CVE-2024-231157.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod CVE-2024-231167.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar CVE-2024-231177.2Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2024-231187.2Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute CVE-2024-231198.8Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr CVE-2024-23126.7GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after CVE-2024-231207.8A maliciously crafted STP and STEP file, when parsed in ASMIMPORT228A.dll and ASMIMPORT229A.dll through Autodesk AutoCAD, may force an Out-o CVE-2024-231217.8A maliciously crafted MODEL file, when parsed in libodxdll.dll through Autodesk AutoCAD, may force an Out-of-Bounds Write vulnerability. A m