← Back

CVE-2023-40721

nvd nist
Published: Feb 11, 2025Modified: Jun 17, 2026

JSON object

Loading...
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: psirt@fortinet.com (Secondary)

Description

A use of externally-controlled format string vulnerability [CWE-134] vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests.

Affected (9)

Fortinet
4 products
Fortios
Fortiswitchmanager
Fortiproxy
Fortipam
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortios
From 6.2.0 to 7.0.14
Fortios
From 7.2.0 to 7.2.7
Fortios
Version 7.4.0
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiswitchmanager
From 7.0.0 to 7.0.3
Fortiswitchmanager
From 7.2.0 to 7.2.3
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Fortinet
Fortiproxy
From 1.2.0 to 7.0.15
Fortiproxy
From 7.2.0 to 7.2.8
Fortiproxy
Version 7.4.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Fortipam
From 1.0.0 to 1.2.0

Related CWEs

CWE-134
Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (1)

Source: psirt@fortinet.com
Vendor Advisory

Timeline

No history available yet.