Fortiwlm - SQLi (CVE-2023-34993)
58Exploiting IPs reported
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
CrowdSec analysis
CVE-2023-34993 is a vulnerability in Fortinet FortiWLM that exposes systems to remote code execution through improper neutralization of special elements in OS commands. Attackers can leverage specially crafted requests to interact with management endpoints and execute unauthorized commands on the target device.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
CrowdSec network observations suggest that most exploitation of CVE-2023-34993 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2023-34993 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Observed exploitation typically involves requests to URLs containing /ems/cgi-bin/ezrf_upgrade_images.cgi.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.