CVE-2024-32123: OS command injection in CLI command

Q: What is the severity of CVE-2024-32123?

CVE-2024-32123 has been classified with a high severity due to its potential for remote code execution through os command injection.

Q: How do I fix CVE-2024-32123?

To mitigate CVE-2024-32123, upgrade FortiManager and FortiAnalyzer to versions 7.4.4 or higher, or 7.2.6 or higher accordingly.

Q: Which versions are affected by CVE-2024-32123?

CVE-2024-32123 affects Fortinet FortiManager and FortiAnalyzer versions from 6.0.0 to 7.4.2.

Q: Can CVE-2024-32123 be exploited remotely?

Yes, CVE-2024-32123 can be exploited remotely by an attacker due to the improper neutralization of command input.

Q: What types of products are impacted by CVE-2024-32123?

CVE-2024-32123 impacts Fortinet products including FortiManager and FortiAnalyzer across multiple versions.

Published Mar 11, 2025

Updated

Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer versions 7.4.0 through 7.4.2 7.2.0 through 7.2.5 and 7.0.0 through 7.0.12 and 6.4.0 through 6.4.14 and 6.2.0 through 6.2.12 and 6.0.0 through 6.0.12 and 5.6.0 through 5.6.11 and 5.4.0 through 5.4.7 and 5.2.0 through 5.2.10 and 5.0.0 through 5.0.12 and 4.3.4 through 4.3.8 allows attacker to execute unauthorized code or commands via crafted CLI requests.

Other sources

Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities [CWE-78] in FortiManager CLI may allow a privileged attacker to execute unauthorized code or commands via crafted CLI requests.

— FortiGuard

Affected Software

28 affected componentsFixes available

Fortinet FortiManager>=7.4.0<=7.4.2, >=7.2.0<=7.2.5, >=7.0.0<=7.0.12, >=6.4.0<=6.4.14, >=6.2.0<=6.2.12, >=6.0.0<=6.0.12, >=5.6.0<=5.6.11, >=5.4.0<=5.4.7, >=5.2.0<=5.2.10, >=5.0.0<=5.0.12, >=4.3.4<=4.3.8

Fortinet FortiAnalyzer>=7.4.0<=7.4.2, >=7.2.0<=7.2.5, >=7.0.0<=7.0.12, >=6.4.0<=6.4.14, >=6.2.0<=6.2.12, >=6.0.0<=6.0.12, >=5.6.0<=5.6.11, >=5.4.0<=5.4.7, >=5.2.0<=5.2.10, >=5.0.0<=5.0.12, >=4.3.4<=4.3.8

Fortinet FortiAnalyzer>=7.4.0<=7.4.3

Fortinet FortiAnalyzer>=7.2.0<=7.2.5

Fortinet FortiAnalyzer>=7.0

Fortinet FortiAnalyzer>=6.4

Fortinet FortiAnalyzer>=6.2

Fortinet FortiAnalyzer-BigData>=7.4.0<=7.4.1

Fortinet FortiAnalyzer-BigData>=7.2.0<=7.2.7

Fortinet FortiAnalyzer-BigData>=7.0

Fortinet FortiAnalyzer-BigData>=6.4

Fortinet FortiManager>=7.4.0<=7.4.3

Fortinet FortiManager>=7.2.0<=7.2.5

Fortinet FortiManager>=7.0

Fortinet FortiManager>=6.4

Fortinet FortiManager>=6.2

Fortinet FortiManager>=6.0

Fortinet FortiManager>=5.6

Fortinet FortiManager>=5.4

Fortinet FortiManager>=5.2

Fortinet FortiManager>=5.0

Fortinet FortiManager>=4.3.4<=4.3.8

Fortinet FortiAnalyzer>=6.2.0<7.2.6

Fortinet FortiAnalyzer>=7.4.0<7.4.4

Fortinet Fortianalyzer Big Data>=6.4.5<7.2.8

Fortinet Fortianalyzer Big Data>=7.4.0<7.4.2

Fortinet FortiManager>=4.3.4<7.2.6

Fortinet FortiManager>=7.4.0<7.4.4

Remediation

Information

Please upgrade to FortiAnalyzer-BigData version 7.4.2 or above Please upgrade to FortiAnalyzer-BigData version 7.2.8 or above Please upgrade to FortiAnalyzer version 7.4.4 or above Please upgrade to FortiAnalyzer version 7.4.3 or above Please upgrade to FortiAnalyzer version 7.2.6 or above Please upgrade to FortiManager version 7.6.0 or above Please upgrade to FortiManager version 7.4.4 or above Please upgrade to FortiManager version 7.2.6 or above

Event History

Mar 11, 2025

Advisory Published

via FortiGuard·12:00 AM

CVE Published

via MITRE·02:54 PM

Data Sourced

via MITRE·02:54 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·03:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-32123?