CVE-2023-40721

CWE-134 — Uncontrolled Format String4 documents4 sources
Severity
6.7MEDIUM
EPSS
0.0%
top 94.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Fortinet FortiosFortinet FortipamFortinet Fortiproxy+1 more
Timeline
PublishedFeb 11

Description

A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages8 packages

▶NVDfortinet/fortios6.2.0 — 7.0.14+2
▶NVDfortinet/fortipam1.0.0 — 1.2.0
▶NVDfortinet/fortiproxy1.2.0 — 7.0.15+2
▶NVDfortinet/fortiswitchmanager7.0.0 — 7.0.3+1
▶CVEListV5fortinet/fortios7.2.0 — 7.2.5+4

🔴Vulnerability Details

2
CVEList
CVE-2023-40721: A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code↗2025-02-11
▶
GHSA
GHSA-8hp7-6pv7-c4rv: A use of externally-controlled format string vulnerability [CWE-134] in Fortinet FortiOS version 7↗2025-02-11
▶

📋Vendor Advisories

1
Fortinet
FortiOS / FortiProxy / FortiPAM / FortiSwitchManager - Format string vulnerability in CLI commands↗2025-02-11
▶
CVE-2023-40721 (MEDIUM CVSS 6.7) | A use of externally-controlled form | cvebase.io