Paper/Archive/CVE-2023-25610

CVE-2023-25610

Fortinet FortiSwitchManager — A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, v…

EPSS 18%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 97.2.972 × 2019.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Affected

ProductAffectedFixed inSource

FortiSwitchManager7.2.0 – 7.2.1–CNA

FortiSwitchManager7.0.0 – 7.0.1–CNA

FortiAnalyzer7.2.0–CNA

FortiAnalyzer7.0.0 – 7.0.4–CNA

FortiAnalyzer6.4.0 – 6.4.11–CNA

FortiAnalyzer6.2.0 – 6.2.10–CNA

FortiAnalyzer6.0.0 – 6.0.11–CNA

FortiOS-6K7K7.0.5–CNA

FortiOS-6K7K6.4.10–CNA

FortiOS-6K7K6.4.8–CNA

FortiOS-6K7K6.4.6–CNA

FortiOS-6K7K6.4.2–CNA

Scores by source

fortinet (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reffortiguard.com/psirt/FG-IR-23-001