CVE-2023-25610
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 18.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 18.33% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-124
- Affected
- fortinet/fortiweb · fortinet/fortiswitchmanager · fortinet/fortiswitch · fortinet/fortiproxy · fortinet/fortios-6k7k · fortinet/fortios · fortinet/fortimanager · fortinet/fortianalyzer
- Source
- psirt@fortinet.com
References
- https://fortiguard.com/psirt/FG-IR-23-001Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.