CVE-2023-40717

published 2023-09-13

CVE-2023-40717: A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to…

Priority P3 46 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell on the device to access the database via shell commands.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	—	—
fortinet	fortitester	2.3.0 – 7.2.3	—
fortinet	fortitester	2.4.0 – 2.4.1	—
fortinet	fortitester	3.3.0 – 3.3.1	—
fortinet	fortitester	3.5.0 – 3.5.1	—
fortinet	fortitester	3.7.0 – 3.7.1	—
fortinet	fortitester	3.9.0 – 3.9.2	—
fortinet	fortitester	4.1.0 – 4.1.1	—
fortinet	fortitester	4.2.0 – 4.2.1	—
fortinet	fortitester	7.1.0 – 7.1.1	—
fortinet	fortitester	7.2.0 – 7.2.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-798