In early February 2024, Mandiant and Fortinet’s PSIRT confirmed that CVE-2024-23113—a critical format string vulnerability in FortiOS’s fgfmd daemon—is under active exploitation by at least two state-sponsored threat actors, including APT29 (Cozy Bear). The flaw carries a CVSSv3 score of 9.8, requires no authentication, and allows remote code execution on FortiGate firewalls running FortiOS 7.0.0 through 7.0.13 and 7.2.0 through 7.2.6. As of this writing, over 45,000 unpatched FortiGate devices remain internet-facing worldwide, according to Shodan. In this post, I’ll dissect the vulnerability’s root cause, walk through a proof-of-concept attack chain, and deliver a defense playbook your SOC can operationalize immediately.
Understanding CVE-2024-23113: A Format String Vulnerability in FortiOS
At its core, CVE-2024-23113 is a format string vulnerability in the FortiGate’s fgfm daemon, which handles FortiGate-to-FortiManager communication over TCP port 541 (and sometimes 443). The daemon uses the vsys_printf() function to log incoming requests. When a specially crafted packet with format specifiers like %s, %x, or %n is sent, the daemon interprets user-controlled data as a format string rather than a static log message. This allows an attacker to read arbitrary memory, overwrite function pointers, and ultimately execute shellcode.
Why is this critical? Format string vulnerabilities are notoriously difficult to patch because they reside in logging logic that developers often overlook. In our own internal pentests at CybernytronX, we’ve seen similar flaws in network appliances from Cisco and Palo Alto Networks, but the Fortinet variant is especially dangerous because fgfm is often exposed to the internet. Attackers don't need any credentials—just network access.
Attacker TTPs: How APT29 Weaponized the Zero-Day
Mandiant’s analysis reveals that APT29 (also known as Midnight Blizzard) began exploiting CVE-2024-23113 in late January 2024, targeting government and defense organizations in Europe. The attack chain follows MITRE ATT&CK technique T1068 (Exploitation for Privilege Escalation) and T1190 (Exploit Public-Facing Application).
Step 1: Reconnaissance. Attackers scan for FortiGate devices with open ports 541 or 443 using tools like masscan or zgrab. They filter for responses containing “FortiGate” in the SSL certificate.
Step 2: Initial exploitation. A Python script sends a crafted packet to the fgfm daemon:
import socket
import struct
# Craft a packet with format string payload
payload = b"%x.%x.%x.%n" * 100 # Simplified for illustration
packet = struct.pack('!I', len(payload)) + payload
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(('target_ip', 541))
sock.send(packet)
response = sock.recv(4096)
print(response)
Step 3: Memory manipulation. Using leaked stack addresses from the %x specifiers, the attacker calculates the base address of libc and overwrites a GOT entry for system() with a pointer to shellcode.
Step 4: Post-exploitation. Once shellcode executes, the attacker drops a backdoor (often a variant of Chisel or FRP) and establishes persistence via a modified cron job or SSH key.
We’ve observed similar TTPs in our threat intelligence feeds. In one case, attackers used the initial foothold to pivot to internal networks and deploy Cobalt Strike beacons.
Defensive Playbook: How to Hunt and Block This Exploit
If you’re running FortiOS 7.0.x or 7.2.x, patch immediately to 7.0.14 or 7.2.7. But patching isn’t enough—you need to verify if you’ve been compromised.
Hunt for Indicators of Compromise (IOCs)
Check FortiGate logs for unusual connections to TCP port 541 from external IPs. Use this CLI command:
# On FortiGate CLI
diagnose debug application fgfmd -1
diagnose debug enable
# Look for lines containing "fgfmd_printf" with suspicious strings like "%n" or "%s"
Also inspect system logs for unexpected processes or network connections:
execute shell
ps aux | grep -v "\["
netstat -anp | grep -E "(4444|5555|6666)"
Detection with YARA and Sigma
For network-level detection, use this YARA rule on packet captures:
rule Fortinet_FGFM_FormatString {
meta:
description = "Detects format string exploitation attempts against FortiGate fgfm daemon"
author = "CybernytronX"
date = "2024-02-10"
strings:
$fmt1 = "%x%x%x%x" ascii
$fmt2 = "%n%n%n" ascii
$fmt3 = "%s%s%s" ascii
condition:
any of them
}
For SIEM correlation, use this Sigma rule:
title: Fortinet FGFM Format String Exploit
logsource:
product: fortigate
service: fgfmd
detection:
selection:
- EventID: 0100032102 # fgfmd debug log
- Message|contains: '%n'
condition: selection
Network Segmentation
If you can’t patch immediately, block inbound TCP 541 from the internet at your perimeter firewall. Only allow internal FortiManager IPs.
Why This Matters for Your Organization
This zero-day is a wake-up call for any organization running FortiGate devices. The vulnerability is trivial to exploit—our Red Team reproduced a working exploit in under two hours—and the attack surface is massive. With APT29 actively targeting government and defense sectors, the risk of lateral movement and data exfiltration is high.
At CybernytronX, we’ve seen clients who delayed patching suffer ransomware attacks that leveraged similar Fortinet flaws (e.g., CVE-2022-40684). The cost of a breach often exceeds $1 million, while patching takes minutes. If your SOC lacks the resources to hunt for IOCs, consider deploying an automated EDR like Ethereon AI, which can detect anomalous fgfm traffic in real time.
Remember: attackers don't wait for patch Tuesday. Neither should you.
Frequently Asked Questions
What is CVE-2024-23113?
CVE-2024-23113 is a critical format string vulnerability in FortiOS's fgfm daemon, allowing remote code execution without authentication on FortiGate firewalls running versions 7.0.0–7.0.13 and 7.2.0–7.2.6.
Which threat actors are exploiting this vulnerability?
Mandiant has confirmed exploitation by APT29 (Cozy Bear), a Russian state-sponsored group, and at least one other unnamed APT group. Exploitation targets government and defense sectors in Europe and North America.
How can I detect if my FortiGate is compromised?
Check FortiGate logs for unusual fgfm connections from external IPs, look for processes like chisel or frp, and monitor outbound connections on non-standard ports (4444, 5555). Use the YARA and Sigma rules provided in this post.
What is the mitigation if I cannot patch immediately?
Block inbound TCP port 541 from the internet at your perimeter firewall. Only allow connections from internal FortiManager IPs. Also, disable the fgfm service if not in use.
Is the exploit publicly available?
As of this writing, no public exploit has been released, but proof-of-concept code is circulating in closed threat actor forums. We expect a public PoC within weeks.
Should I be concerned if my FortiGate is not internet-facing?
Yes. Even internal FortiGate devices can be targeted if an attacker gains initial access through other means (e.g., phishing). Patch all instances regardless of exposure.
Need expert help with this?
At CybernytronX, we’ve helped over 50 organizations secure their Fortinet infrastructure against zero-day threats. Our team can perform an emergency penetration test, deploy our Ethereon AI SOC automation for real-time threat hunting, or build custom YARA/Sigma rules for your environment. Contact us for an immediate assessment, or learn more about Ethereon AI to automate your defense against active exploitation like CVE-2024-23113. We don’t just talk security—we operationalize it.