CVE-2023-41678

Published: Dec 13, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to execute unauthorized code or commands via specifically crafted request.

Affected (12)

Products: Fortinet: Fortios, Fortipam

Fortinet

2 products

Fortios

Fortipam

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Fortinet Fortios	Version 7.0.0
Fortinet Fortios	Version 7.0.1
Fortinet Fortios	Version 7.0.2
Fortinet Fortios	Version 7.0.3
Fortinet Fortios	Version 7.0.4
Fortinet Fortios	Version 7.0.5
Fortinet Fortipam	Version 1.0.0
Fortinet Fortipam	Version 1.0.1
Fortinet Fortipam	Version 1.0.2
Fortinet Fortipam	Version 1.0.3
Fortinet Fortipam	Version 1.1.0
Fortinet Fortipam	Version 1.1.1

Related CWEs

CWE-415

Double Free

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (2)

https://fortiguard.com/psirt/FG-IR-23-196

Source: psirt@fortinet.com

Vendor Advisory

https://fortiguard.com/psirt/FG-IR-23-196

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.