CVE-2023-46715

MEDIUM

Fortinet FortiOS <7.4.1, <7.2.6 - Auth Bypass

Title source: llm

Description

An origin validation error [CWE-346] vulnerability in Fortinet FortiOS IPSec VPN version 7.4.0 through 7.4.1 and version 7.2.6 and below allows an authenticated IPSec VPN user with dynamic IP addressing to send (but not receive) packets spoofing the IP of another user via crafted network packets.

References (1)

[Vendor Advisory] https://fortiguard.com/psirt/FG-IR-23-407

Scores

CVSS v3 5.0

EPSS 0.0019

EPSS Percentile 41.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Classification

CWE

CWE-346

Status published

Affected Products (1)

fortinet/fortios < 7.4.2

Timeline

Published Jan 14, 2025

Tracked Since Feb 18, 2026