CVE-2023-25610

Published: Mar 24, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: psirt@fortinet.com (Secondary)

Description

A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.6, version 6.4.0 through 6.4.11 and version 6.2.12 and below, FortiProxy version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.8, version 2.0.12 and below and FortiOS-6K7K version 7.0.5, version 6.4.0 through 6.4.10 and version 6.2.0 through 6.2.10 and below allows a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

Affected (29)

Products: Fortinet: Fortiweb, Fortiswitchmanager, Fortiswitch, Fortiproxy, Fortios 6k7k, Fortios, Fortimanager, Fortianalyzer

8 products

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiweb	From 6.1.0 to 6.1.4
Fortinet Fortiweb	From 6.2.0 to 6.2.8
Fortinet Fortiweb	From 6.3.0 to 6.3.23
Fortinet Fortiweb	From 6.4.0 to 6.4.3
Fortinet Fortiweb	From 7.0.0 to 7.0.7
Fortinet Fortiweb	From 7.2.0 to 7.2.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiswitchmanager	From 7.0.0 to 7.0.2
Fortinet Fortiswitchmanager	From 7.2.0 to 7.2.2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiswitch	From 7.0.0 to 7.0.7
Fortinet Fortiswitch	From 7.2.0 to 7.2.4

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortiproxy	From 1.1.0 to 7.0.9
Fortinet Fortiproxy	From 7.2.0 to 7.2.3

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios 6k7k	From 6.0.4 to 6.2.13
Fortinet Fortios 6k7k	From 6.4.2 to 6.4.12
Fortinet Fortios 6k7k	Version 7.0.5

Configuration F

4 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	From 5.0.0 to 6.2.13
Fortinet Fortios	From 6.4.0 to 6.4.12
Fortinet Fortios	From 7.0.0 to 7.0.10
Fortinet Fortios	From 7.2.0 to 7.2.4

Configuration G

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortimanager	From 6.0.0 to 6.0.12
Fortinet Fortimanager	From 6.2.0 to 6.2.11
Fortinet Fortimanager	From 6.4.0 to 6.4.12
Fortinet Fortimanager	From 7.0.0 to 7.0.5
Fortinet Fortimanager	Version 7.2.0

Configuration H

5 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortianalyzer	From 6.0.0 to 6.0.12
Fortinet Fortianalyzer	From 6.2.0 to 6.2.11
Fortinet Fortianalyzer	From 6.4.0 to 6.4.12
Fortinet Fortianalyzer	From 7.0.0 to 7.0.5
Fortinet Fortianalyzer	Version 7.2.0

Related CWEs

CWE-124

Buffer Underwrite ('Buffer Underflow')

The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.

References (1)

https://fortiguard.com/psirt/FG-IR-23-001

Source: psirt@fortinet.com

Vendor Advisory

Timeline

No history available yet.