The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-23113 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog following active in-the-wild exploitation. The vulnerability is a critical format string flaw (CWE-134) residing in the FortiGate to FortiManager (fgfmd) protocol handler, which listens on TCP port 541 across FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager. Unauthenticated remote adversaries can trigger the flaw by transmitting crafted packets containing format specifiers directly to the management daemon, corrupting memory structures and executing arbitrary code or commands with root privileges on the appliance without valid administrative credentials.

Internet scanning telemetry from Shadowserver and Censys revealed tens of thousands of exposed Fortinet devices remaining susceptible to external exploitation. Threat actors target internet-facing perimeter appliances to achieve unauthenticated initial access, establish persistence, and pivot deeper into enterprise internal networks. In response to confirmed exploitation, CISA issued a binding directive requiring federal civilian agencies to remediate exposed systems. Fortinet urged administrators to upgrade to patched releases (FortiOS 7.4.3, 7.2.7, 7.0.14) or immediately disable FGFM access across public-facing interfaces using unset allowaccess fgfm.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Unauthenticated format string execution in a public-facing management daemon collapses perimeter defenses, granting attackers root-level execution and direct operating system control before any authentication handshake occurs.
• Bullet 2 — Strategic & Defender Imperative: Organizations must urgently patch exposed FortiOS appliances or revoke public fgfm interface bindings, apply strict local-in policies, and audit management logs for unauthorized TCP port 541 connection attempts.