CVE-2023-28002

Published: Nov 14, 2023Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

An improper validation of integrity check value vulnerability [CWE-354] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versions, 6.2 all versions, 6.0 all versions and VMs may allow a local attacker with admin privileges to boot a malicious image on the device and bypass the filesystem integrity check in place.

Affected (8)

Products: Fortinet: Fortios, Fortiproxy

Fortinet

2 products

Fortios

Fortiproxy

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	From 6.0.0 to 6.0.17
Fortinet Fortios	From 6.2.0 to 6.2.15
Fortinet Fortios	From 6.4.0 to 6.4.14
Fortinet Fortios	From 7.0.0 to 7.0.12
Fortinet Fortios	From 7.2.0 to 7.2.3
Fortinet Fortiproxy	From 2.0.0 to 2.0.13
Fortinet Fortiproxy	From 7.0.0 to 7.0.13
Fortinet Fortiproxy	From 7.2.0 to 7.2.7

Related CWEs

CWE-354

Improper Validation of Integrity Check Value

The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.

References (2)

https://fortiguard.com/psirt/FG-IR-22-396

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-22-396

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.