CVE-2023-34992

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to…

Critical9.7EPSS 81.7%

Published: 10 Oct 2023
Updated: 14 Jan 2026
Reserved: 9 Jun 2023
Assigned by: fortinet

Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.

Scores

CVSS scores of CVE-2023-34992, by who scored it
Scored by	CVSS	Score	Vector
fortinetCNA (assigner)	3.1	Critical9.7	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:X/RC:X
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 81.7% · top 0.4% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.7.

Weakness

CWE-78: Execute unauthorized code or commands (opens in a new tab)All about CWE-78 and its CVEs

Affected products

Fortinet · FortiSIEM
- affected 7.0.0
- affected 6.7.0 – ≤ 6.7.5
- affected 6.6.0 – ≤ 6.6.3
- affected 6.5.0 – ≤ 6.5.1
- affected 6.4.0 – ≤ 6.4.2

What to do

Solution: Please upgrade to FortiSIEM version 7.1.2 or above Please upgrade to FortiSIEM version 7.0.3 or above Please upgrade to FortiSIEM version 6.7.9 or above Please upgrade to FortiSIEM version 6.6.4 or above Please upgrade to FortiSIEM version 6.5.3 or above Please upgrade to FortiSIEM version 6.4.4 or above Please upgrade to upcoming FortiSIEM version 7.2.0 or above

References (1)

https://fortiguard.com/psirt/FG-IR-23-130 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-34992](https://trackcve.app/badge/CVE-2023-34992.svg)](https://trackcve.app/cve/CVE-2023-34992)

Record last updated 14 Jan 2026, 13:47 UTC.