Critical

Unauthenticated OS Command Injection in Fortinet FortiSIEM Supervisor

IdentifiersCVE-2024-23109CWE-78· Improper Neutralization of Special…

CVE-2024-23109 is a critical OS command injection vulnerability in the Fortinet FortiSIEM supervisor component. According to the provided content, it is a variant/patch bypass related to CVE-2023-34992 and allows a remote unauthenticated attacker to execute unauthorized code or commands via crafted API requests. Multiple sources in the content state that CVE-2024-23108 and CVE-2024-23109 share the same description and CVSS 10.0 severity, and that exploitation can provide unauthorized WebSocket-based access to Fortinet CLI interfaces. The issue affects FortiSIEM supervisor deployments and is described as enabling remote command execution as root.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows remote unauthenticated command execution on affected FortiSIEM supervisor systems, with multiple references in the content indicating execution as root. This can result in full compromise of the appliance, including arbitrary command execution, unauthorized access to the Fortinet CLI interface, theft of credentials or configuration data, tampering with logs or system settings, establishment of persistence, and use of the compromised system for further lateral movement or initial access operations.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, restrict network access to FortiSIEM management and API surfaces to trusted administrative hosts only, and prevent exposure of affected supervisor interfaces to untrusted networks. Because the content references exploitation through crafted API requests and unauthorized WebSocket access to CLI interfaces, organizations should disable or tightly filter external access paths to those services, monitor for suspicious API/WebSocket activity, and review FortiSIEM logs for anomalous command execution or unauthorized CLI access attempts.

Remediation

Patch, then assume compromise.

Upgrade FortiSIEM to a fixed release as referenced in the provided content and Fortinet advisory FG-IR-23-130. The content states CVE-2024-23109 is fixed or will be fixed in FortiSIEM 7.1.2 or above, 7.2.0 or above, 7.0.3 or above, 6.7.9 or above, 6.6.5 or above, 6.5.3 or above, and 6.4.4 or above. Apply the vendor-provided updates for the affected branch in use and validate that the advisory-referenced patched version has been deployed across all FortiSIEM supervisor instances.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

FortinetFortisiemapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

9 SOURCESView more in app

cyberthroneNews

Jan 14, 2026

CVE-2025-64155 - Critical RCE in Fortinet FortiSIEM - TheCyberThrone

FortiSIEM vulnerability referenced in a related-story snippet; no technical details provided in the main content beyond being critical and associated with RCE in that snippet.

security online infoNews

Jan 14, 2026

Fortinet Critical Alert: CVE-2025-64155 RCE & Config Leaks Exposed

Referenced (in related posts) as a critical command injection flaw in Fortinet FortiSIEM (CVSS 10).

ahnlab asec blogNews

May 15, 2025

April 2025 APT Group Trends

A vulnerability in Fortinet firewall and VPN devices that allows attackers to gain unauthorized access and execute commands via an unauthenticated WebSocket endpoint.

security online infoNews

Apr 21, 2025

APT41/RedGolf Infrastructure Briefly Exposed: Fortinet Zero-Days Targeted Shiseido

An unauthenticated WebSocket-based access vulnerability affecting Fortinet CLI interfaces, enabling attackers to bypass authentication and run privileged CLI commands via a WebSocket exploitation path.

+4 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence1

Every observed campaign linking this CVE to a named adversary.

Associated malware1

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2024-23109

NVD

nvd.nist.gov/vuln/detail/CVE-2024-23109

MITRE CWE · CWE-78

Improper Neutralization of Special Elements…

Vendor Advisory

fortiguard.com/psirt/FG-IR-23-130