CVE-2023-45583

MEDIUM

Fortinet FortiProxy <=7.2.5, <=7.0.11, <=2.0.13, <=1.2.13, <=1.1.6 - Format String Vulnerability via CLI/HTTP

Title source: llm
STIX 2.1

Description

A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0.0 through 6.0.16, FortiPAM 1.1.0, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.5, FortiProxy 7.0.0 through 7.0.11, FortiProxy 2.0 all versions, FortiProxy 1.2 all versions, FortiProxy 1.1 all versions, FortiProxy 1.0 all versions, FortiSwitchManager 7.2.0 through 7.2.2, FortiSwitchManager 7.0.0 through 7.0.2 allows attacker to execute unauthorized code or commands via specially crafted cli commands and http requests.

References (1)

Core 1
Core References

Scores

CVSS v3 6.7
EPSS 0.0065
EPSS Percentile 46.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-134
Status published
Products (17)
fortinet/fortios 7.4.0
fortinet/fortios < 7.2.6
Fortinet/FortiOS 6.2.0 - 6.2.17
Fortinet/FortiOS 6.4.0 - 6.4.16
Fortinet/FortiOS 7.0.0 - 7.0.12
Fortinet/FortiOS 7.2.0 - 7.2.5
Fortinet/FortiOS 7.4.0
fortinet/fortipam 1.1.0
fortinet/fortipam 1.0.0 - 1.0.3
Fortinet/FortiPAM 1.0.0 - 1.0.3
... and 7 more
Published May 14, 2024
Tracked Since Feb 18, 2026